The latest Microsoft 365 supply-chain attack is another warning that cybersecurity's biggest vulnerabilities aren't always found in a CVE database. Sometimes they're buried in the trusted connections organizations have already authorized.
Attackers exploited application credentials associated with ConnectWise Cloud Backup, formerly SkyKick, to gain unauthorized access to Microsoft 365 customer tenants. Huntress confirmed suspicious authentication activity in at least 162 tenants, while investigators observed attempts to escalate privileges, establish persistence and manipulate other trusted applications.
The incident reinforces a pattern we've been tracking at CYBR.SEC.Media: attackers increasingly exploit the trust relationships connecting software vendors, cloud platforms, managed service providers and enterprise customers. They don't necessarily need to compromise Windows itself, discover a new vulnerability or trick an employee into surrendering credentials. Sometimes the permissions granted to a trusted application are enough.
That presents a serious problem for security teams already struggling to distinguish exploitable risks from an overwhelming flood of vulnerability alerts.
Cloaked's Arjun Bhatnagar: The danger is in what we already trust
For Arjun Bhatnagar, co-founder and CEO of Cloaked, the ConnectWise incident illustrates a fundamental weakness in how organizations think about security: Once an identity or application earns trust, the systems around it often assume that trust remains justified.
In an analysis published by Cloaked, Bhatnagar examines how attackers exploited credentials associated with ConnectWise Cloud Backup to authenticate into Microsoft 365 customer environments through existing application permissions.
The danger is that the activity can look legitimate. The attacker isn't necessarily breaking through an authentication barrier. They're using credentials and permissions the organization has already authorized.
According to BleepingComputer, ConnectWise disabled its Cloud Backup service after discovering unauthorized access involving application identities used to connect with Microsoft 365 tenants.
Huntress, which investigated the activity, confirmed unauthorized application sign-ins across 162 customer tenants as of October 16. Researchers also identified suspicious activity involving ConnectWise Cloud Management applications in approximately 50 tenants, including directory role assignments.
In one environment, Huntress observed an application obtaining Global Administrator privileges and adding credentials to other trusted applications, creating a potential mechanism for persistent access. Huntress cautioned that not every observed activity could be conclusively attributed to the same operator.
ConnectWise reported no evidence that stored backup archives had been compromised, although the broader investigation remained ongoing.
The lesson from Bhatnagar's analysis is particularly uncomfortable: Organizations can enforce MFA, patch their systems and maintain sophisticated endpoint defenses while remaining exposed through third-party identities they don't fully control.
And that gets to the heart of the problem Cloaked has set out to address.
Why Cloaked sees privacy as part of the enterprise attack surface
I met Bhatnagar and Cloaked founding senior account executive Dustin Wade at CruiseCon AI/Privacy 2026, where we discussed a related weakness in enterprise security: the vast amount of personal information available to attackers.
As I wrote in my CruiseCon ship's log, Cloaked's underlying premise is that an employee doesn't stop being part of the corporate attack surface when they close their work laptop.
Attackers can use personal email addresses, phone numbers, breached credentials, family relationships and information purchased from data brokers to build convincing phishing, vishing and impersonation campaigns. AI makes collecting, correlating and weaponizing that information dramatically easier.
Bhatnagar's interest in privacy began with a personal experiment in 2020. He built an AI system that aggregated his health records, finances, messages and other personal information into a centralized digital profile. When that system independently communicated with his then-girlfriend, he began questioning the consequences of concentrating so much sensitive information in one place.
That experience helped inspire Cloaked, which initially focused on giving users different phone numbers, email addresses and passwords rather than repeatedly exposing the same identifiers. The company's approach later expanded to reducing personal information already circulating through data brokers and other sources.
The connection to ConnectWise isn't that Cloaked's products could have prevented this particular breach. There's no evidence that personal data exposure caused the compromise of the ConnectWise application credentials.
Rather, the two problems share a broader security principle:
Every unnecessary piece of exposed information, every excessive permission and every trusted connection gives attackers another potential advantage.
Cloaked approaches that problem by reducing what adversaries can learn about individuals. The ConnectWise incident demonstrates why enterprises must apply similar scrutiny to the application identities and third-party relationships operating inside their environments.
In both cases, the question is how much exposure organizations can eliminate before attackers have an opportunity to exploit it.
Another chapter in the software supply-chain meltdown
The ConnectWise incident follows a series of compromises that we've examined at CYBR.SEC.Media.
In The Week the Software Supply Chain Melted Down, we explored attacks involving Trivy, LiteLLM, Axios and other software components. Those incidents showed how attackers could compromise trusted development pipelines, steal credentials and potentially extend their reach into downstream organizations.
ConnectWise represents a different entry point into essentially the same problem.
Rather than poisoning a software package or compromising a release pipeline, attackers abused credentials associated with a trusted cloud application. That allowed unauthorized access to customer environments through permissions those customers had already granted.
The common denominator is delegated authority.
Software components trust repositories. Development pipelines trust automation tokens. Microsoft 365 tenants trust third-party applications. Managed service providers maintain privileged connections across numerous customer environments.
Each relationship makes modern enterprise technology easier to operate. Each also introduces a potential attack path.
This matters particularly in Microsoft environments, where Windows endpoints, Entra ID identities, Microsoft 365 applications and third-party management tools form an interconnected ecosystem.
The ConnectWise incident doesn't establish that Windows itself was compromised. It shows that attackers can reach sensitive Microsoft cloud resources without exploiting a Windows vulnerability at all.
The CVE stampede won't solve this problem
That distinction reinforces another argument we've made recently in The CVE Stampede Is a Distraction. Finding the Vulns That Matter Is the Challenge.
Security teams are overwhelmed by vulnerability disclosures, severity scores and patching requirements. But some of the most dangerous exposures aren't conventional software vulnerabilities.
Based on the findings disclosed so far, the ConnectWise attack centered on compromised application credentials and previously granted permissions. The exact method used to obtain those credentials remains unclear.
An organization could have fully patched Windows systems, enforced MFA for every employee and maintained an aggressive vulnerability remediation program while still being exposed through a compromised third-party application identity.
That is why vulnerability management must evolve into broader exposure management.
Security teams need to know not only which software components are vulnerable, but which identities, integrations and vendors have access to critical systems, what those permissions enable and how quickly that access can be revoked.
The situation becomes even more complicated as organizations lose some of the vulnerability intelligence they previously relied upon.
In NIST Declares Inbox Zero, Pulls Back on CVE Enrichment, we examined how changes to the National Vulnerability Database are placing more responsibility on enterprises to determine which vulnerabilities pose meaningful risks.
But even perfect CVE enrichment wouldn't reveal whether a trusted backup application's credentials had been stolen or whether its permissions allowed attackers to establish persistence across a Microsoft 365 tenant.
Those exposures require identity monitoring, application inventories, permission reviews and continuous assessment of third-party access.
What Microsoft 365 defenders should do now
The technical findings from Huntress and reporting by BleepingComputer point to several immediate defensive priorities:
- Audit service principal activity. Examine Microsoft Entra ID sign-in logs for suspicious ConnectWise Cloud Backup activity, including application ID
506e08f9-6e9a-4da4-942b-a099a03644aeand connections from144.172.64.128. - Inspect trusted integrations. Review ConnectWise Cloud Management and legacy SkyKick applications for unexpected role assignments, permission changes and authentication activity.
- Investigate persistence mechanisms. Look for unauthorized application secrets, certificates, OAuth permission changes and suspicious Microsoft Graph operations.
- Contain compromised access. Disable affected integrations where appropriate, preserve forensic evidence and coordinate remediation with vendors.
- Reduce unnecessary permissions. Inventory enterprise applications and remove excessive privileges and integrations no longer required for business operations.
The larger priority is treating non-human identities with the same seriousness organizations apply to privileged human accounts.
A service principal with extensive Microsoft Graph permissions can become a powerful attacker-controlled identity when its credentials are compromised. Unlike an employee, it can execute actions at machine speed without triggering familiar human authentication defenses.
The security industry must rethink what constitutes exposure
The larger pattern emerging from these incidents is difficult to ignore.
Software supply-chain compromises expose credentials. Stolen credentials unlock trusted integrations. Those integrations create opportunities to reach additional applications, systems and organizations.
Meanwhile, personal information scattered across data brokers, breaches and public sources gives attackers the intelligence needed to target the humans who administer those systems.
These are different attack paths, but they challenge the same assumption: that organizations can adequately protect themselves by securing the assets inside their traditional perimeter.
Bhatnagar's work at Cloaked raises a question that deserves more attention from enterprise security leaders: How much risk can organizations eliminate by reducing what attackers can learn about their people?
The ConnectWise breach extends that question to enterprise infrastructure: How much risk can organizations eliminate by reducing what third-party applications are allowed to access?
Neither personal privacy tools nor application permission reviews can eliminate supply-chain attacks. But both reflect a shift toward reducing the attack surface before a compromise occurs, rather than relying entirely on detecting and responding afterward.
The industry's vulnerability management machinery was built largely around finding defects in software and fixing them.
Attackers are increasingly showing that they don't always need a defect.
Sometimes the most dangerous vulnerability is the information we've exposed and the access we've already granted.
