Threat intelligence research published today details architectural vulnerabilities in delegated cloud application trust relationships. Threat actors leveraged compromised vendor identity credentials to execute malwareless data exfiltration operations across client cloud organizations.
The supply chain incident involved stolen application credentials associated with ConnectWise Cloud Backup formerly SkyKick. Unauthenticated remote adversaries utilized valid administrative service tokens to authenticate to Microsoft Entra ID formerly Azure Active Directory endpoints. Because client tenants granted persistent delegated administrative access to the vendor application, adversaries executed legitimate API calls to query user directories, download Exchange Online mailboxes, and inspect SharePoint repositories across 173 enterprise cloud environments without dropping local malware binaries.
Relying on persistent delegated administrative permissions creates severe cloud supply chain exposure. When a third-party vendor application credential is compromised, adversaries can ride existing OAuth consent grants directly into customer tenant environments without triggering multi-factor authentication or password reset barriers.
– Revoke all delegated administrative privileges and active OAuth tokens associated with ConnectWise Cloud Backup immediately.
– Enforce granular, time-bound Partner Admin relationships granular delegated admin privileges GDAP across all tenant environments.
– Audit Microsoft Entra ID sign-in logs for high-volume service principal API calls originating from unverified external IP addresses.
– Restrict OAuth application consent policies to require explicit administrator approval for multi-tenant application requests.
Cloud identity governance requires continuous partner permission auditing and strict non-human identity monitoring to ensure enterprise cloud tenants remain protected against supply chain credential abuse. #CodeDefence #ConnectWise #Microsoft365 #EntraID #SupplyChain #IdentitySecurity #CloudSecurity #AppSec
/
