Intruder granted itself global admin rights in the ConnectWise breach

ConnectWise detected the attack on 15 October and on 17 October disabled seven application identities and revoked their certificates. Help Net Security reports that Cloud Backup, SaaS Security and Cloud Management were suspended as of 19 October: no scheduled backups are running, and customers cannot restore data either. The product, formerly SkyKick, was bought in 2024 and forms part of a platform reaching more than 100,000 managed service providers. A managed service provider, or MSP, is a firm that runs its clients' information systems remotely.

The figures on scale diverge. Huntress has confirmed unauthorised access in at least 162 Microsoft 365 tenants; sign-in attempts were made against roughly 1,000 accounts from the attacking address and more than 300 succeeded. Bank Info Security reports that in most cases the intruder established persistence within five minutes of the first sign and worked through targets in alphabetical order. In one case the Cloud Management Teams application made itself global administrator, then added credentials valid until 2028 to two trusted applications, including Huntress's own.

The target set stands out. The same address also went after 16 institutions working on policy, national security, trade and critical minerals on 15 October, and those attempts failed because no ConnectWise application was present. Microsoft described the incident as a supply chain attack. How the credentials leaked and who the attacker is had not been disclosed as of 19 October, and ConnectWise said it was not yet determined whether a product flaw played a part.