/
← Voltar ao feed
critical managed service providers legal government trade critical minerals technology

ConnectWise Cloud Backup (SkyKick) vendor credential abused to access 162+ Microsoft 365 tenants and plant persistence

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 20:00 · coletado há 11 horas

Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64[.]128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found almost 1,000 Entra tenants with sign-in activity from the IP, over 300 of them successful. The credential was a client assertion, so it lives in the vendor's own tenant and customers could not have caused the compromise. Post-compromise activity in two tenants was scripted and indiscriminate: the app granted itself Global Administrator and planted secrets on other applications, including Huntress's own app. Unauthorized secrets were added to a Huntress application in one customer tenant. ConnectWise acknowledged the incident and, per the October 17 update, disabled the relevant apps. Huntress also saw a second, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors. No attribution is made.

Technical Details

  • Timeline: Password spraying against four law firm tenants from the same IP on Oct 13-14 (curl/7.88.1; two accounts locked out). From 01:58 UTC on Oct 15, ConnectWise Cloud Management service principals assigned themselves directory roles (mostly Exchange Administrator) in ~50 tenants, using the vendor-typical kiota-dotnet user agent. Between 03:44 and 03:49 UTC, the Cloud Management MS Teams app added itself to Global Administrator in one tenant, then a Python script (Python-urllib/3.12) added client secrets (expiring 2028) to an MSP management app and the Huntress Security Platform app. A certificate addition failed with a thumbprint mismatch.
  • Token theft: Between 06:13 and 08:34 UTC, the app authenticated from 144.172.64[.]128, walking tenants in sorted GUID order, which indicates a script working from a target list. The last confirmed successful sign-in was at 08:44 UTC on Oct 15.
  • Targeted wave: On Oct 15 the actor swept 16 tenants for SkyKick Graph tokens (09:25-12:35 UTC). A second, apparently manual sweep (13:54-14:20 UTC) targeted Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra and the O365 Management APIs. Attempts failed where the service principal was absent.
  • Post-compromise behavior: In two tenants, self-granted Global Administrator and secret planting occurred within two minutes of each other around 03:45 UTC on Oct 15. Target apps looked randomly chosen. Access from private Azure IPv6 space, not the known IP, was used to add the Huntress app credential. Huntress removed it on Oct 16 and enabled App Instance Property Lock on its apps.
  • Visibility gaps: Microsoft Graph directory reads leave no audit trail, and app-only audit events carry no source IP. No mailbox, file, user or policy changes were seen in the reviewed tenants, but data access cannot be ruled out.
  • ATT&CK mapping: T1078.004 (valid cloud accounts), T1098.003 (additional cloud roles), T1098.001 (additional cloud credentials).
  • Affected apps: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. Older tenants may show "SkyKick Cloud Manager".

Remediation

  • Disable (do not delete) the ConnectWise/SkyKick enterprise applications in Entra, even if logs look clean. Deleting removes consent.
  • Review service principal sign-ins from roughly 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Look for any non-Microsoft/Azure IP, especially 144.172.64[.]128.
  • Remove directory roles not intentionally granted to these apps, including Global Administrator and Privileged Authentication Administrator.
  • Audit client secrets and certificates on all enterprise apps and app registrations, especially MSP management and security tools, for any added since Oct 13. Remove unexpected ones.
  • Check Entra audit logs for "Add member to role", "Update application" and "Add service principal credentials" by these apps, and check user agents (kiota-dotnet is vendor-typical; Python-urllib/3.12 is not).
  • Review Conditional Access exclusions for these apps. Do not re-enable them until ConnectWise confirms all credentials are reset. Consider application management policies to restrict client secrets.

Linha do tempo

  1. huntress.com ↗ · pub. 16/10/2026 20:00 · coletado 20/10 16:30 primeiro registro

    ConnectWise Cloud Backup (SkyKick) vendor credential abused to access 162+ Microsoft 365 tenants and plant persistence

    ler a análise desta fonte

    Huntress reports that a stolen vendor credential for ConnectWise Cloud Backup (formerly SkyKick) was used on October 15, 2026 to obtain Microsoft Graph tokens in customer Microsoft 365 tenants from the hosting IP 144.172.64[.]128. As of 19:00 UTC on October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later updates found almost 1,000 Entra tenants with sign-in activity from the IP, over 300 of them successful. The credential was a client assertion, so it lives in the vendor's own tenant and customers could not have caused the compromise. Post-compromise activity in two tenants was scripted and indiscriminate: the app granted itself Global Administrator and planted secrets on other applications, including Huntress's own app. Unauthorized secrets were added to a Huntress application in one customer tenant. ConnectWise acknowledged the incident and, per the October 17 update, disabled the relevant apps. Huntress also saw a second, targeted wave against 16 tenants in the policy, national security, trade and critical minerals sectors. No attribution is made.

    Technical Details

    • Timeline: Password spraying against four law firm tenants from the same IP on Oct 13-14 (curl/7.88.1; two accounts locked out). From 01:58 UTC on Oct 15, ConnectWise Cloud Management service principals assigned themselves directory roles (mostly Exchange Administrator) in ~50 tenants, using the vendor-typical kiota-dotnet user agent. Between 03:44 and 03:49 UTC, the Cloud Management MS Teams app added itself to Global Administrator in one tenant, then a Python script (Python-urllib/3.12) added client secrets (expiring 2028) to an MSP management app and the Huntress Security Platform app. A certificate addition failed with a thumbprint mismatch.
    • Token theft: Between 06:13 and 08:34 UTC, the app authenticated from 144.172.64[.]128, walking tenants in sorted GUID order, which indicates a script working from a target list. The last confirmed successful sign-in was at 08:44 UTC on Oct 15.
    • Targeted wave: On Oct 15 the actor swept 16 tenants for SkyKick Graph tokens (09:25-12:35 UTC). A second, apparently manual sweep (13:54-14:20 UTC) targeted Exchange Online, SharePoint, Teams, Azure Resource Manager, Entra and the O365 Management APIs. Attempts failed where the service principal was absent.
    • Post-compromise behavior: In two tenants, self-granted Global Administrator and secret planting occurred within two minutes of each other around 03:45 UTC on Oct 15. Target apps looked randomly chosen. Access from private Azure IPv6 space, not the known IP, was used to add the Huntress app credential. Huntress removed it on Oct 16 and enabled App Instance Property Lock on its apps.
    • Visibility gaps: Microsoft Graph directory reads leave no audit trail, and app-only audit events carry no source IP. No mailbox, file, user or policy changes were seen in the reviewed tenants, but data access cannot be ruled out.
    • ATT&CK mapping: T1078.004 (valid cloud accounts), T1098.003 (additional cloud roles), T1098.001 (additional cloud credentials).
    • Affected apps: ConnectWise Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. Older tenants may show "SkyKick Cloud Manager".

    Remediation

    • Disable (do not delete) the ConnectWise/SkyKick enterprise applications in Entra, even if logs look clean. Deleting removes consent.
    • Review service principal sign-ins from roughly 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Look for any non-Microsoft/Azure IP, especially 144.172.64[.]128.
    • Remove directory roles not intentionally granted to these apps, including Global Administrator and Privileged Authentication Administrator.
    • Audit client secrets and certificates on all enterprise apps and app registrations, especially MSP management and security tools, for any added since Oct 13. Remove unexpected ones.
    • Check Entra audit logs for "Add member to role", "Update application" and "Add service principal credentials" by these apps, and check user agents (kiota-dotnet is vendor-typical; Python-urllib/3.12 is not).
    • Review Conditional Access exclusions for these apps. Do not re-enable them until ConnectWise confirms all credentials are reset. Consider application management policies to restrict client secrets.