How a Trusted Backup App Became a Back Door: The ConnectWise Breach Explained
Last week, Microsoft published a report on a cyberattack that didn't break down anyone's front door. Instead, the attackers took over a trusted cloud app that thousands of businesses had already let into their Microsoft 365 accounts, and they used an AI hacking tool to move fast. Here's what happened in the ConnectWise breach, why this kind of attack is so hard to spot, and what you can do if your business relies on third-party cloud apps.
What happened
ConnectWise makes software that IT service providers use to look after their clients. These providers are often called MSPs (managed service providers): the outside companies many small and mid-sized businesses pay to run their IT. One ConnectWise product, Cloud Backup (formerly known as SkyKick), backs up Microsoft 365 data such as email, Teams chats and SharePoint files.
To do that job, the backup app needs permission to reach into each customer's Microsoft 365 environment, which Microsoft calls a tenant. Think of a tenant as a company's private space inside Microsoft's cloud, with its own users, mailboxes and settings.
According to The Register, ConnectWise said in an October 16 advisory that it had "identified unauthorized access to application identities within the ConnectWise Cloud Backup environment." In plain terms, someone had stolen the digital keys the app uses to prove who it is. ConnectWise took Cloud Backup offline and suspended its SaaS Security and Cloud Management services "out of an abundance of caution." As of October 18, those services were still unavailable.
On October 21, Microsoft said it assesses that a group it tracks as Storm-0940, which it describes as a China-state aligned actor active since 2021, was behind the compromise. ConnectWise told The Register it couldn't discuss attribution.
Why a trusted app makes such a good disguise
Here's the clever, and worrying, part. The attackers didn't need anyone's password. Microsoft says they used the stolen app credentials to take "advantage of the already established trust by these apps within a tenant." Because the backup app was already approved, its activity looked normal at first glance.
Picture an office building that gives its cleaning company a master key card. Nobody questions the cleaners walking the halls at night, because they're supposed to be there. Now imagine someone copies that card. They can open every door the cleaners can, and the security log just shows the usual badge being swiped. That's roughly what happened here, except the building had thousands of tenants, and the copied card was tried on all of them.
Once inside some environments, Microsoft says, the attackers carried out reconnaissance (quietly mapping what's there), added new credentials to apps so they could come back later, and made changes to identities, groups and privileged roles. Security firm Huntress told The Register that in one partner's tenant, a ConnectWise app "gave itself Global Administrator," the highest level of control in Microsoft 365.
Where AI comes in
Microsoft's report puts a spotlight on a tool called ARTEX. Microsoft describes it as "an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows." Penetration testing is the legitimate practice of hacking your own systems to find weak spots before criminals do. The catch is that the same tools work just as well for real attackers.
Microsoft says Storm-0940 used ARTEX to speed up scanning, password spraying (trying a few common passwords against lots of accounts) and abuse of cloud app permissions. With it, the group attempted to sign in to more than 2,250 tenants. In multiple cases, Microsoft says, the time from first targeting to privileged access was less than three hours.
That speed matters. Plenty of security teams still work on a rhythm of daily alerts and weekly reviews. An attack that can go from first knock to admin rights before lunch leaves very little time to react.
What we don't know yet
It's worth keeping the numbers in perspective. The 2,250 figure counts tenants the attackers tried to get into, not tenants they actually broke into. Microsoft says "the majority of the targeting wasn't successful," though several attacks did reach privileged access. It hasn't said how many organizations were affected.
Microsoft also stresses that having the affected app installed, or even spotting the attackers signing in, "does not necessarily indicate that customer data was accessed or exfiltrated." It says the activity didn't come from a flaw in Microsoft's own systems. And how the attackers first got hold of the app's keys hasn't been publicly confirmed.
Want the video version? This whole story comes down to who (and what) is allowed into your systems, and KP walks through identity and access management here:
What this means for you
If you run IT for a business, or you pay someone who does, here are the practical steps, drawn mostly from Microsoft's guidance:
Check whether ConnectWise Cloud Backup or related ConnectWise apps are, or ever were, connected to your Microsoft 365 tenant. If they are, keep those connections disabled until ConnectWise gives formal restoration instructions.
Don't just delete the apps as your first move. Microsoft advises preserving configuration and logs first so you don't destroy evidence. Huntress also warns that disabling the apps won't remove credentials the attackers already added.
Review sign-in and audit logs from at least October 15, and ideally from October 1, for new app credentials, new admin role assignments and new consent grants. If something looks suspicious, revoke the permissions and rotate credentials.
Take stock of every third-party app with access to your cloud accounts, and give each one only the permissions it truly needs. Security people call this least privilege.
If an MSP manages your IT, ask them directly whether they used the affected ConnectWise services and what they've checked.
For everyone else, the takeaway is simple: every app you connect to your email or cloud storage is a key you've handed out. It's worth knowing who's holding them.
We've spent years learning to spot phishing emails and pick strong passwords. This breach points to the next front line: the quiet, trusted connections between cloud services. Those connections are what make modern IT work, and that's exactly why attackers want them. As AI tools speed attacks up, the businesses that keep a tidy list of who has access, and check it often, will be best placed to catch the next copied key card.
Keep learning: dive into KP's CISSP Masterclass for full lessons on every security domain, including identity and access management. You'll find all of KP's playlists on the Tech Explained YouTube channel page.
Sources
Photos: Winston Chen and Taylor Vick on Unsplash
