TL;DR Threat actors stole a vendor API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 environments. During this ConnectWise Cloud Backup breach, attackers signed in to over 300 Microsoft Entra tenants and planted backdoor credentials in select environments. Consequently, ConnectWise suspended its backup and management services while security teams urge administrators to audit their application secrets immediately.