Cloud security incident response writeups published today detail an ongoing supply chain intrusion campaign targeting managed service provider integration accounts. Threat actors compromised administrative application credentials to bypass multi-factor authentication controls across client cloud tenants.
The attack campaign involved the compromise of service credentials associated with ConnectWise Cloud Backup formerly SkyKick. Unauthenticated remote threat actors leveraged the stolen administrative credentials to gain unauthorized access across 173 Microsoft 365 tenant environments globally. Adversaries exploited the elevated service permissions to query user directories, export mailbox contents, and create rogue administrative OAuth application registrations. ConnectWise disabled affected application access tokens while conducting incident remediation.
Subverting managed service provider cloud backup accounts destroys tenant isolation and cloud identity boundaries. Because MSP backup integrations hold elevated delegation permissions across customer cloud environments, stolen application credentials allow threat actors to access client data without triggering account password reset alerts.
– Revoke and rotate all ConnectWise Cloud Backup service principal integration tokens and delegated administrative permissions.
– Audit Microsoft Entra ID audit logs across managed tenants for unverified administrative logins or OAuth consent grants.
– Enforce strict conditional access policies restricting administrative API calls to trusted IP ranges and compliant devices.
– Review service provider partner access relationships and restrict global admin rights across delegated tenant integrations.
Cloud supply chain security requires rigorous partner permission auditing and continuous service principal monitoring to ensure corporate cloud tenants remain protected against supply chain account hijacking. #CodeDefence #ConnectWise #Microsoft365 #EntraID #SupplyChain #IdentitySecurity #CloudSecurity #AppSec
/
