ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants
Attackers exploited compromised application identities (service principals) within ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenant environments, bypassing MFA entirely because the attack operated through trusted service-level credentials rather than user accounts. This highlights a critical blind spot in MFA strategies: machine-to-machine identities and service principals are often unprotected by the same authentication controls applied to human users. Once inside, attackers escalated privileges by assigning themselves administrative roles, demonstrating how a single compromised third-party integration can cascade into full tenant takeover. Supply-chain attacks of this nature are particularly dangerous because organizations implicitly trust their vendors' tools, often granting them broad permissions with little ongoing oversight.
Tactical Insight
Immediate actions
- Audit and revoke all unnecessary service principal permissions and OAuth application consents across your Microsoft 365 tenants immediately.
- Review admin role assignments in Microsoft 365 for any unauthorized or unrecognized accounts added after October 15th.
- Temporarily suspend or isolate third-party backup integrations until vendor remediation is confirmed and validated.
Long-term improvements
- Apply the principle of least privilege to all service principals and application identities, granting only the minimum permissions required for each integration.
- Establish a formal vendor risk management process that includes periodic reviews of third-party application permissions and security posture.
- Implement Conditional Access Policies in Microsoft 365 to restrict service principal access by IP range, location, and behavioral baselines.
Detection measures
- Enable and continuously monitor Microsoft 365 Unified Audit Logs for anomalous role assignments, privilege escalations, and unusual service principal activity.
- Deploy SIEM alerting rules specifically targeting new Global Administrator or privileged role assignments originating from non-human identities.
- Integrate Microsoft Entra ID (Azure AD) sign-in and audit logs into your SOC workflow to detect service principal abuse in near real-time.