/
← Voltar ao feed
critical managed service providers technology

ConnectWise Cloud Backup (SkyKick) credentials abused to access 162 Microsoft 365 tenants; backup service access shut off

1 fonte(s) · 1 atualização(ões) · publicado 17/10/2026 09:27 · coletado há 1 dia

Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, and said it has no indicators that stored partner backup data was compromised. Data theft is unconfirmed, but the application holds broad permissions, so exposure may extend to every organization that has consented to it.

Technical Details

  • On October 15, between 06:13 and 08:34 UTC, the attacker used the compromised application credential to obtain Microsoft Graph tokens from hosting-provider IP 144.172.64[.]128. Requests moved through tenants in sorted identifier order, seconds apart, which suggests automated targeting.
  • Authenticating as the trusted application meant inheriting the permissions already approved in each tenant. The application covers Microsoft 365 mailboxes, OneDrive, SharePoint, Teams and directory information.
  • In one partner tenant, a second application, ConnectWise Cloud Management – MS Teams, assigned itself Global Administrator and then added client secrets to two other applications: an MSP management application and a partner-specific Huntress Security Platform application. The secrets were set to expire in 2028, giving persistence independent of the original credential.
  • These changes happened about 2.5 hours before the observed public-IP authentications. Huntress has not established that both activity sequences involved the same operator. A logged private IPv6 address cannot identify the operator.
  • Absence of visible mailbox or file activity does not prove safety, because directory reads lack audit visibility.

Remediation

  • Disable, rather than delete, ConnectWise Cloud Backup application 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management – MS Teams application 24205314-2b89-4e07-a2a4-579e898a5640. Review other ConnectWise applications.
  • Inspect Microsoft Entra service principal sign-in logs for suspicious authentication, including from 144.172.64[.]128. Investigate unexpected directory-role assignments and application modifications.
  • Review client secrets and certificates across application registrations and enterprise applications. Remove unauthorized credentials added since October 13 and revoke unexpected privileges, since disabling the vendor applications does not remove planted secrets.
  • Keep affected applications disabled until ConnectWise confirms credential resets. Existing stored backups are not deleted, but plan for the backup interruption.

Linha do tempo

  1. gbhackers.com ↗ · pub. 17/10/2026 09:27 · coletado 19/10 17:54 primeiro registro

    ConnectWise Cloud Backup (SkyKick) credentials abused to access 162 Microsoft 365 tenants; backup service access shut off

    ler a análise desta fonte

    Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, and said it has no indicators that stored partner backup data was compromised. Data theft is unconfirmed, but the application holds broad permissions, so exposure may extend to every organization that has consented to it.

    Technical Details

    • On October 15, between 06:13 and 08:34 UTC, the attacker used the compromised application credential to obtain Microsoft Graph tokens from hosting-provider IP 144.172.64[.]128. Requests moved through tenants in sorted identifier order, seconds apart, which suggests automated targeting.
    • Authenticating as the trusted application meant inheriting the permissions already approved in each tenant. The application covers Microsoft 365 mailboxes, OneDrive, SharePoint, Teams and directory information.
    • In one partner tenant, a second application, ConnectWise Cloud Management – MS Teams, assigned itself Global Administrator and then added client secrets to two other applications: an MSP management application and a partner-specific Huntress Security Platform application. The secrets were set to expire in 2028, giving persistence independent of the original credential.
    • These changes happened about 2.5 hours before the observed public-IP authentications. Huntress has not established that both activity sequences involved the same operator. A logged private IPv6 address cannot identify the operator.
    • Absence of visible mailbox or file activity does not prove safety, because directory reads lack audit visibility.

    Remediation

    • Disable, rather than delete, ConnectWise Cloud Backup application 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management – MS Teams application 24205314-2b89-4e07-a2a4-579e898a5640. Review other ConnectWise applications.
    • Inspect Microsoft Entra service principal sign-in logs for suspicious authentication, including from 144.172.64[.]128. Investigate unexpected directory-role assignments and application modifications.
    • Review client secrets and certificates across application registrations and enterprise applications. Remove unauthorized credentials added since October 13 and revoke unexpected privileges, since disabling the vendor applications does not remove planted secrets.
    • Keep affected applications disabled until ConnectWise confirms credential resets. Existing stored backups are not deleted, but plan for the backup interruption.