A ConnectWise credential opens 173 Microsoft 365 tenants

Security researchers have raised the alarm over an active campaign in which threat actors, still unidentified, are exploiting a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to their customers' M365 environments. The figure that sums up the severity: that single credential has been used to sign in to 173 tenants of Microsoft 365.

It is worth understanding what ConnectWise Cloud Backup is: a cloud backup and recovery service designed for managed service providers (MSPs). In other words, we are not talking about a tool that an SMB installs on a laptop, but a piece of infrastructure that many MSPs use to protect and manage their customers' data. When that piece is compromised, the problem does not stay with one user: it multiplies across every customer connected to it.

Why a single credential can be worth 173

The pattern is well known in the MSP ecosystem: an account with elevated privileges over multiple tenants becomes a master key. If that key leaks, the attacker does not need to breach each company one by one; they come in through the front door and move from there. In this case, the compromised credential belongs to a backup service, which adds an uncomfortable nuance: backup systems often have visibility and permissions over large volumes of data, and are frequently configured to run unattended.

For an SMB, the immediate takeaway is that your security also depends on your provider's security. If your company works with an MSP that manages your Microsoft 365, your exposure does not end at your firewall. And if you are the one providing IT services, this incident is a reminder that the chain of trust must be reviewed as seriously as your own perimeter.

What it means for an IT team

Beyond the headline, there are several operational lessons worth paying attention to:

• Service accounts are risk accounts. A credential used by a backup or integration tool should not have more permissions than strictly necessary, nor should it live forever without rotation.
• Multi-tenant access requires centralized visibility. If you manage several customers, you need to know who signs in, from where, and with what role. Without unified logs, an anomalous sign-in goes unnoticed.
• Backup is not only recovery, it is also an attack surface. Protecting data means protecting the system that copies it.
• Multi-factor authentication is not enough if the credential is a service one. MFA must be combined with conditional access policies and review of authorized applications.

This type of incident fits a trend we have already discussed on the blog: security is shifting toward the supply chain and third-party tools. We saw it when analyzing how Anthropic opens its cyber AI to verified teams, and it appears again here: trust in a provider is one more vector.

Concrete recommendations for SMBs and MSPs

There is no need to wait for an official statement to act. These are the measures we recommend at ForgeNEX:

1. Inventory your Microsoft 365 integrations. Make a list of applications, service accounts, and connectors that have access to your tenant. If you do not know how many there are, that is the first problem.
2. Review permissions and apply least privilege. Remove inherited access, reduce global roles, and separate administrative accounts from daily-use ones.
3. Rotate credentials and secrets. Establish a rotation cadence for service keys and third-party tools, and document who knows them.
4. Enable sign-in logs and alerts. Monitor access from unusual locations, service accounts signing in interactively, and spikes in backup activity.
5. Ask your provider. If an MSP manages your M365, ask them to confirm whether they use ConnectWise Cloud Backup, what measures they have taken, and what visibility you have into access.
6. Test recovery, not just backup. A continuity plan is only worth something if it has been rehearsed. Use this to review what would happen if the backup system were compromised.

ForgeNEX's analysis

The report does not detail the exact method by which the credential reached the attackers, nor the full scope of the affected data. So it is best not to draw conclusions the report does not support. What is clear is the pattern: a single compromised point of trust can open dozens or hundreds of organizations. For an SMB, the practical conclusion is that security is no longer only what you protect in-house, but also what you delegate outside.

At ForgeNEX we work with the idea that identity and access management is the new perimeter. Reviewing integrations, limiting privileges, and monitoring sign-ins is not a luxury for large companies: it is the difference between finding out about an incident in hours or in weeks. And in a scenario like the one described, those hours count.

If your company depends on a provider to manage Microsoft 365, the question is not only whether you trust them, but whether you can verify what is happening with your access.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.