Security researchers have uncovered an active campaign where unknown hackers are misusing a compromised Microsoft 365 credential to infiltrate numerous cloud environments. The stolen login details belong to ConnectWise Cloud Backup, formerly known as SkyKick. This administrative access has allowed unauthorized individuals to breach at least 173 distinct customer tenant systems without raising immediate suspicion.
The attackers leveraged the compromised service account to bypass standard security controls and enter sensitive corporate networks. ConnectWise Cloud Backup functions as a critical cloud storage and disaster recovery tool for many organizations. Because these backup solutions often hold elevated permissions, they make prime targets for malicious actors seeking broad access. Once inside the system, the intruders can potentially manipulate data, extract confidential files, or set up persistent backdoors.
Security analysts tracking the campaign noted that the unauthorized logins occurred over a sustained period before detection. The threat actors used legitimate credential pathways, making their malicious activities blend in with normal administrative routines. This technique highlights the severe risks associated with third-party vendor integrations and shared cloud services. When a single administrative account is compromised, the downstream effects can immediately jeopardize hundreds of downstream clients who rely on that vendor for safety.
Organizations using cloud backup tools must review their access logs immediately to spot any unusual sign-in behaviors. Security teams are urging IT administrators to enforce strict monitoring protocols around all privileged service accounts. Detecting unauthorized entry points early remains the best defense against widespread data exposure in enterprise cloud ecosystems.
Mitigating risks from third-party vendor breaches requires a proactive approach to identity and access management. Companies should implement multi-factor authentication across all administrative tiers and regularly audit connected applications. Restricting legacy authentication protocols also closes common loopholes that attackers exploit during automated credential-stuffing campaigns.
The long-term outlook for cloud security emphasizes zero-trust architectures and continuous behavioral monitoring. As supply chain attacks become more sophisticated, vendors and clients must share responsibility for maintaining rigorous digital defenses. Neglecting third-party access permissions leaves a gaping hole that motivated cybercriminals will readily exploit.
What service was targeted in this cyber attack? The attackers compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup, which was previously known as SkyKick.
How many customer environments were affected? Investigators have confirmed that the unauthorized actors successfully accessed at least 173 distinct Microsoft 365 tenant environments.
Why do hackers target cloud backup credentials? Backup services typically hold elevated privileges across cloud networks, giving intruders broad access to systems and sensitive data.