5 casos · pág. 1/1
A threat actor obtained a highly sensitive API secret for ConnectWise Cloud Backup (formerly SkyKick) and used it to sign in to customers' Microsoft 365 tenants, forcing ConnectWise to suspend its Cloud Backup, SaaS Security and Cloud Management services. Huntress saw sign-in activity from the malicious infrastructure across almost 1,000 …
ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an…
Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64.128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found…
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed alm…
