ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management after unauthorized access to application identities in its Cloud Backup environment, the service formerly known as SkyKick.

The company’s status page follows the incident from an October 16 investigation notice to an October 17 decision to shut off Cloud Backup application access. ConnectWise says it disabled seven application identities at 07:00 UTC on October 17, revoked the certificates behind the affected connections and invalidated the shared Cloud Backup credentials. SaaS Security and Cloud Management went offline too, because both are integrated with Cloud Backup. In its latest update, at 01:28 UTC on October 19, scheduled backups, archive access and restores were still unavailable, with no confirmed restoration time.

ConnectWise reports that it has engaged a third-party forensics firm, has seen no successful threat activity in the environments it monitors since the mitigations, and has no evidence that the encrypted backup archives were accessed. It also says its own investigation cannot show whether a given customer’s Microsoft 365 environment saw unauthorized activity, because Cloud Backup gives it no visibility into those environments. Access tokens issued before the shutdown may stay usable until they expire, and disabling the applications does not reverse changes already made inside a tenant.

ConnectWise tells partners to filter the service principal sign-in logs for the Cloud Backup application, review activity from 144.172.64[.]128, 144.172.64[.]99 and 144.172.64[.]60, and check credentials, role assignments and mailbox changes in their own tenant and in each customer tenant they manage.

In our reading, administrators should know which third-party service principals hold tenant-wide permissions in their Microsoft 365 accounts, since an application identity acts without any person signing in. That list belongs in the exposure inventory that shortens the first hour after an advisory, and the backup tooling on it deserves the production-grade controls argued for in our opinion on guarding backups.

Source: ConnectWise, Cloud Backup Issue Investigation (status page)