ConnectWise Cloud Backup (SkyKick) supply-chain attack abuses service principals to breach Microsoft 365 tenants
ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an active supply-chain attack. Activity began at least on October 13-15, 2026, from a single IP address, 144.172.64[.]128. The victim count, the extent of data theft and the way the attacker obtained the vendor credentials remain unclear. As of October 18, Cloud Backup, SaaS Security and Cloud Management remain offline, and ConnectWise reports no evidence that stored backup archives were compromised.
Technical Details
- The attacker authenticated directly to Microsoft 365 as the backup application using its secret, via automated scripts. These were non-interactive service principal sign-ins, so MFA was ineffective.
- The app's previously granted permissions (Microsoft assesses this likely included Directory.ReadWrite.All) allowed reading and writing mail, OneDrive/SharePoint files and Teams chats.
- Huntress saw ConnectWise Cloud Management service principals (Exchange Online, Teams, Graph) assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants. In one tenant, "Cloud Management - MS Teams" granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application, in about five minutes.
- Microsoft observed backdoor persistence, Microsoft Graph API reconnaissance and attempts to add further credentials. Todyl found only sign-in activity in nine tenants it analyzed.
- Source IP: 144.172.64[.]128, also linked to scripted sign-ins on October 13-14 with user agent curl/7.88.1. Other user agents: python-urllib/3.12, python-requests/2.31, python-requests/2.34.2.
- Legitimate Cloud Backup app ID abused: 506e08f9-6e9a-4da4-942b-a099a03644ae. Other ConnectWise Cloud Management app IDs to check are listed in the IOC field.
Remediation
- Review service principal sign-ins in Entra filtered by the Cloud Backup application ID, and look for unexpected source addresses.
- Disable the implicated ConnectWise applications. Older tenants may list them as "SkyKick Cloud Manager".
- Review secrets and certificates across all applications for unauthorized additions since October 13 and remove them. The vendor shutdown does not remove credentials already planted in tenants.
- Review application credential changes, OAuth grants, directory role assignments and Graph activity.
- Existing tokens remain valid until they expire, and revoking user sessions does not end application-based access.
Linha do tempo
-
ConnectWise Cloud Backup (SkyKick) supply-chain attack abuses service principals to breach Microsoft 365 tenants
ler a análise desta fonte ocultar
ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an active supply-chain attack. Activity began at least on October 13-15, 2026, from a single IP address, 144.172.64[.]128. The victim count, the extent of data theft and the way the attacker obtained the vendor credentials remain unclear. As of October 18, Cloud Backup, SaaS Security and Cloud Management remain offline, and ConnectWise reports no evidence that stored backup archives were compromised.
Technical Details
- The attacker authenticated directly to Microsoft 365 as the backup application using its secret, via automated scripts. These were non-interactive service principal sign-ins, so MFA was ineffective.
- The app's previously granted permissions (Microsoft assesses this likely included Directory.ReadWrite.All) allowed reading and writing mail, OneDrive/SharePoint files and Teams chats.
- Huntress saw ConnectWise Cloud Management service principals (Exchange Online, Teams, Graph) assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants. In one tenant, "Cloud Management - MS Teams" granted itself Global Administrator and added credentials to an MSP management tool and to Huntress's own application, in about five minutes.
- Microsoft observed backdoor persistence, Microsoft Graph API reconnaissance and attempts to add further credentials. Todyl found only sign-in activity in nine tenants it analyzed.
- Source IP: 144.172.64[.]128, also linked to scripted sign-ins on October 13-14 with user agent curl/7.88.1. Other user agents: python-urllib/3.12, python-requests/2.31, python-requests/2.34.2.
- Legitimate Cloud Backup app ID abused: 506e08f9-6e9a-4da4-942b-a099a03644ae. Other ConnectWise Cloud Management app IDs to check are listed in the IOC field.
Remediation
- Review service principal sign-ins in Entra filtered by the Cloud Backup application ID, and look for unexpected source addresses.
- Disable the implicated ConnectWise applications. Older tenants may list them as "SkyKick Cloud Manager".
- Review secrets and certificates across all applications for unauthorized additions since October 13 and remove them. The vendor shutdown does not remove credentials already planted in tenants.
- Review application credential changes, OAuth grants, directory role assignments and Graph activity.
- Existing tokens remain valid until they expire, and revoking user sessions does not end application-based access.