A Stolen ConnectWise Credential Walked Into 173 Microsoft 365 Tenants
An attacker used ConnectWise Cloud Backup's own app credential to sign in to 173 partner and customer Microsoft 365 tenants, per Huntress. ConnectWise has taken the service offline and disabled seven app identities.
Someone got hold of a credential belonging to ConnectWise Cloud Backup (the Microsoft 365 backup tool formerly sold as SkyKick) and used it to sign in to customer tenants as the app itself. Huntress counted confirmed unauthorized sign-ins in 173 partner and customer tenants, and Truesec, which spotted the breach on Oct. 15, calls it a supply-chain attack. ConnectWise has taken Cloud Backup offline and disabled seven of its application identities, The Hacker News reports. The company says it is still working out how the credential was exposed.
For defenders
Affected: ConnectWise Cloud Backup (SkyKick), app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, plus six ConnectWise Cloud Management apps (Teams, Exchange Online, SharePoint Online, MS Graph, Partner Center and the base app) that ConnectWise has also disabled. Full app IDs are in ConnectWise’s advisory. No CVE has been assigned.
What happened: Huntress says the actor used the app’s own credential to request Microsoft Graph tokens from a hosting-provider IP instead of Azure. In one tenant, the Cloud Management Teams app added itself to Global Administrator, and then client secrets were added to two other applications, one of them Huntress’s own. ConnectWise says disabling the apps does not undo changes already made inside a tenant. Huntress also tracked a separate, failed wave against 16 tenants in policy, national security, trade and critical-minerals work. Truesec says that targeting points to espionage. The actor is unknown.
ATT&CK (per Huntress): T1078.004 (Valid Accounts: Cloud Accounts), T1098.003 (Account Manipulation: Additional Cloud Roles), T1098.001 (Account Manipulation: Additional Cloud Credentials). The same infrastructure also ran password sprays (T1110.003 (Brute Force: Password Spraying)).
144.172.64[.]128 (primary, AS14956)
144.172.64[.]99 (password spray)
144.172.64[.]60 (failed logins)
144.172.94[.]243 (failed login spray, per Huntress Oct. 19)Python-urllib/3.12
python-requests/2.31
curl/7.88.1What it means for you
This mostly matters if a managed IT provider runs your Microsoft 365 email and files, since MSPs are the ones who use this tool. Because the attacker logged in as a trusted backup app, your staff’s passwords and two-factor prompts never came into play. Ask your IT provider whether they use ConnectWise Cloud Backup or SkyKick and whether they’ve checked your account. If you manage your own Microsoft 365 and never installed it, there’s nothing to do.
Do this now
- In Entra, disable the ConnectWise and SkyKick enterprise apps but don’t delete them, and keep them off until ConnectWise confirms every credential has been reset.
- Open Sign-in logs, switch to the Service principal sign-ins tab (the default user tab won’t show this), and filter on the app IDs above from Oct. 13 onward. Look for any IP outside Microsoft ranges.
- Search audit logs for “Add member to role”, “Update application” and “Add service principal credentials”. Remove role assignments you didn’t grant and any app secrets or certificates added since Oct. 13.
- Export sign-in and audit logs before you clean up. Graph directory reads leave no audit trail, so Huntress warns that the full impact may never be measurable.