Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants

Linha do tempo

1. thehackernews.com ↗ · pub. 17/10/2026 03:16 · coletado 19/10 17:53 primeiro registro

   Compromised ConnectWise Cloud Backup (SkyKick) OAuth app credential used to access 173+ Microsoft 365 tenants

   ler a análise desta fonte ocultar

   An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authentication on October 15, 2026 from 144.172.64[.]128. The app holds broad consented permissions (mailboxes, OneDrive, SharePoint, Teams, directory data), so the attacker inherits that access in every tenant where it is installed. ConnectWise has shut off Cloud Backup application access and says it has found no evidence that partner backup data was compromised; the investigation is ongoing. The article also briefly covers a separate campaign: the UNC7017 tampering of AOMEI Backupper update infrastructure to deliver CROSSROAD and SHINYROAD.

   Technical Details

   • The actor authenticated as the app using its own tooling and obtained Microsoft Graph tokens from 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, moving through tenants in sorted GUID order a few seconds apart, which suggests a script working from a target list.
   • The same IP password-sprayed four law firm tenants on October 13-14, 2026; Huntress saw no successful user sign-ins.
   • In at least one partner tenant, the ConnectWise Cloud Management app for Teams (24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator, then ran a Python script (User-Agent Python-urllib/3.12) that added new client secrets to an MSP management application and to Huntress's own application.
   • Microsoft assesses that privileged permissions such as Directory.ReadWrite.All were likely abused, with follow-on Graph API reconnaissance and attempts to add credentials to the related service principal as a backdoor.
   • Todyl notes the consent allows read/write to mail (full mailbox via EWS), OneDrive/SharePoint, and Teams chats, including restore. Revoking user sessions does not end access; already-issued tokens stay valid up to 90 minutes. Some directory reads via Graph leave no audit trail.
   • Huntress observed a possible affinity for alphabetical targeting (victims starting with 'A').
   • AOMEI Backupper (April-July 2026): per Google Mandiant/GTIG and ManageEngine, 5-10 minute tampering windows redirected the updater to a malicious ZIP from attacker servers. It contained the CROSSROAD downloader, which uses scheduled-task persistence to deploy the SHINYROAD modular backdoor via DLL sideloading. Victims spanned IT services, telecoms and higher education in Australia, Brazil, India, Pakistan, Portugal, Singapore, South Africa, Spain, Switzerland, Türkiye and the U.S.

   Remediation

   • Disable the ConnectWise Cloud Backup app in tenants until ConnectWise confirms all credentials are reset.
   • Enable Microsoft Graph activity logs.
   • In Entra sign-in logs (Service principal sign-ins tab), filter by AppId 506e08f9-6e9a-4da4-942b-a099a03644ae and review sign-ins from IPs outside expected Microsoft/Azure ranges; normal egress is Azure private IPv6.
   • Audit for credentials added to applications since October 13, 2026, OAuth grant changes, and ConnectWise/SkyKick apps adding themselves to directory roles.
   • Block 144.172.64[.]128 and review the listed ConnectWise Cloud Management application IDs.