ConnectWise Cloud Backup Security Incident: What Cove Customers Should Know

Summary

We’re aware of the recent security incident involving ConnectWise Cloud Backup, formerly SkyKick, and understand that Cove Data Protection customers may have questions. Based on our review, we found no evidence that Cove was affected, and no action is required by Cove customers.

This document explains the details that have been shared about the incident, how Cove authenticates to Microsoft 365, how N-able protects our credentials and defends the systems around them, and what every Microsoft 365 administrator can do to reduce the risk of a similar incident with any vendor application.

What happened

Based on the information available to us, an attacker used a credential belonging to ConnectWise’s own multi-tenant Microsoft application to sign in to customer Microsoft 365 tenants as the application itself. Because the sign-ins were made by an application rather than a user, no password or MFA prompt was involved. The compromised credential could then be used in customer tenants that had previously consented to the application. The incident was not the result of a vulnerability in the Microsoft 365 connection model itself. The attacker obtained a ConnectWise application credential maintained within ConnectWise’s own infrastructure. How that credential was obtained remains under investigation by ConnectWise.

Microsoft 365 backup providers, including Cove, commonly use multi-tenant applications that customers authorize through administrator consent. The ConnectWise incident involved credentials specific to its application, rather than credentials located within customer Microsoft 365 environments. For the incident itself, see ConnectWise’s advisories and the independent analyses listed under Sources.

What this means for Cove customers

Cove is a separate platform with its own infrastructure, application registrations, credentials, cloud storage, and data centers. These systems are operated independently from ConnectWise and SkyKick, and no infrastructure or credentials are shared between the platforms. Based on our review of logs, access permissions and testing, N-able has found no evidence that Cove was affected by this incident.

Because Cove uses its own application credentials, access to a ConnectWise-specific credential does not provide access to Cove’s environment or credentials.

How Cove protects Microsoft 365

Protecting customer data and preventing unauthorized access are fundamental to how Cove is operated. Cove’s Microsoft 365 integration rests on three principles: application credentials are certificates that are rotated on a defined schedule; permissions are limited to what backup and restore require; and access tokens are short-lived and issued only inside our production network.

Customers stay in control of the connection

• Access starts with your consent. Cove connects to a tenant only after a Global Administrator of that tenant completes Microsoft’s admin-consent flow. Cove verifies the Global Administrator role of the signing-in account before the connection is accepted.
• Customers can see and revoke the connection at any time. Consent creates a service principal for Cove under Enterprise applications in the Entra Admin Center. From there, customers can review granted permissions, disable sign-ins, or remove the service principal; Cove cannot prevent or reverse that.
• Cove never handles customer passwords. The connection is a Microsoft OAuth application grant. Cove does not store, request or process user credentials or MFA factors for any tenant.

Encryption in transit and at rest

• In transit. Every connection between customers’ tenants, Microsoft, Cove’s services and Cove storage uses TLS.
• At rest, the platform layer. Databases, object storage and volumes in Cove’s AWS environment are encrypted with AES-256 using AWS KMS-managed keys, with key access restricted to authorized operations staff and logged.
• At rest, the data layer. Backed-up Microsoft 365 data is additionally encrypted with AES-256 using a key specific to customers’ account before it is written to Cove storage.
• Regional storage. Backup data stays in the N-able storage region selected by customers and is not moved between regions.

N-able maintains recognized security standards and certifications, including ISO 27001 and SOC 2, as part of our broader approach to protecting systems and protecting data. We continuously review these controls against new attack techniques, including those used in this incident, and publish material changes through the N-able Trust Center.

What Microsoft 365 administrators can do

Any third-party application with access to Microsoft 365 tenant becomes part of that tenant’s broader security environment. That makes regular review of application access and permissions an important security practice. These steps apply to every tenant you manage, whether it ever used ConnectWise.

Reduce your exposure to vendor applications

Inventory enterprise applications in every tenant. In the Entra Admin Center, review Enterprise applications and disable or remove anything no longer in use. Dormant ConnectWise or SkyKick applications should be handled according to ConnectWise’s guidance.

Watch service-principal sign-ins, not just user sign-ins. Application sign-ins appear under the Service principal sign-ins tab of the Entra sign-in logs. Entra keeps these logs for only 7 days on the Free tier and 30 days with P1 or P2, so route them to a Log Analytics workspace, storage account or SIEM through a diagnostic setting, making sure the service-principal sign-in category is selected, if you want to investigate anything older.

Check application credentials and roles. Look for client secrets or certificates on any application that you did not add, and directory roles held by service principals that you did not grant. Start with the management tools that reach your clients’ tenants.

Restrict who can consent and who can manage applications. Limit user consent to verified publishers or disable it; keep the Application Administrator and Cloud Application Administrator roles to a minimum; use Conditional Access for workload identities where your licensing allows.

Monitor for unexpected application changes. In the Entra audit log, alert on the activities “Add service principal credentials”, “Update application – Certificates and secrets management”, “Add member to role” where the member is a service principal, and “Add app role assignment to service principal”; Microsoft Sentinel ships templates for each, and Microsoft’s Entra security operations guide for applications lists the full set. In Microsoft 365, enable the built-in alert policy for new forwarding and redirect rules. Where your licensing includes it, Entra ID Protection can also flag risky workload identities.

Protect your Cove environment

Review Cove’s access on your own terms. Cove’s service principal is visible under Enterprise applications in each tenant. Include its permissions and sign-in activity in your regular access reviews, and disable it there if you ever need to.

Protect the Cove Management Console as a privileged system. Restrict administrative roles to the few people who need them, and review Cove’s audit log for restores, exports and settings changes you do not recognize.

Five questions to ask any vendor with application access to your tenants

• How does the application authenticate to Microsoft, and how often is its credential rotated?
• Which permissions does it request, and why does it need each of them?
• Where are its credentials stored, who can reach them, and is that access logged?
• Are production credentials fully separate from test and development environments?
• How quickly can the vendor revoke and re-issue a credential if one is suspected of compromise, and will you be told?

Questions and contacts

• Compliance questionnaires, SOC 2 report requests and policy questions: Trust Center
• Report a vulnerability: Vulnerability Disclosure Program

We will update this page if anything in the public record about the ConnectWise incident changes our assessment.

Sources

• ConnectWise Trust Center advisories
• Kudelski Security: ConnectWise Cloud Backup (formerly SkyKick) vendor credential abused
• BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
• Blumira: ConnectWise Cloud Backup (SkyKick) compromise
• N-able Security and Privacy and N-able Trust Center

Thank you for your continued trust in N-able.