A backup app that every customer trusted turned into the way in. One stolen client secret, 162 Microsoft 365 tenants, and not a single user sign-in to challenge.
- ConnectWise Cloud Backup authenticates as an application, so multi-factor authentication and user conditional access never applied. Huntress had confirmed 162 tenants reached by the evening of 16 October.
- Revoking user sessions does not end application access. Disabling the app stops new tokens, but tokens already issued keep working for up to 90 minutes, and nothing planted elsewhere is removed.
- In one tenant a second ConnectWise app granted itself Global Administrator, then added client secrets set to expire in 2028 to two other applications.
The fix is an audit of application credentials across the tenant, not a review of mailbox activity. Search Entra for the application IDs, review every application for credentials added since 13 October, and get written confirmation that the publisher rotated its secret.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.