Skip to content
Hacker Posts

ConnectWise Cloud Backup credential abused in M365 attacks

A compromised credential for ConnectWise Cloud Backup (ex-SkyKick) let attackers sign in to 162+ Microsoft 365 tenants and self-grant admin roles. Disable the app and audit now.

Published Updated 4 min read
threat-intelconnectwisemicrosoft-365supply-chain

Attackers are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to the M365 tenants that have consented to the app. Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16 — and warns the credential works against every tenant where the app is installed, so the real figure is higher. If you run ConnectWise or SkyKick apps in M365, treat this as active now.

The primary source is Huntress's writeup, ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks by Jonathan Semon, corroborated by Todyl and by Microsoft, which flagged it on X as an active supply-chain attack. The Hacker News put the tenant count higher, at 173; we use Huntress's timestamped 162. No group has claimed responsibility, and no CVE is involved — this is abuse of a trusted vendor's OAuth app, not a software flaw.

Update: ConnectWise suspends seven app identities

ConnectWise has now disabled seven application identities and suspended Cloud Backup by revoking the certificates behind the affected connections; it also took SaaS Security and Cloud Management offline. Disabling the connections does not undo changes an attacker already made inside a tenant — the audit steps below still apply. Per The Hacker News, the disabled App IDs are:

506e08f9-6e9a-4da4-942b-a099a03644ae  Cloud Backup
2399d300-6fca-4e6a-a686-399fefe75b83  Cloud Management
24205314-2b89-4e07-a2a4-579e898a5640  Cloud Management - MS Teams
b78f6a77-d4e5-46fb-87e5-d1648bd02519  Cloud Management - Exchange Online
0de14c77-b9b0-4137-9360-34878a929827  Cloud Management - MS Graph
412dcf96-176d-4b3a-a1b0-4981ad66971e  Cloud Management - Partner Center
b2b55f5b-7758-4719-8d8f-88ae172e6bdb  Cloud Management - SharePoint Online

Huntress revised the scope upward: almost 1,000 Entra tenants saw sign-in attempts from 144.172.64[.]128 and over 300 succeeded — a larger, different measure than the 162 confirmed above, which Huntress says should not be added to it. Earlier the same day, Huntress noted the Exchange Online, Teams, and SharePoint Cloud Management apps did not appear disabled on its checks, so verify each App ID in your own tenant rather than assume ConnectWise caught them all.

Huntress also flagged a second, hands-on-keyboard wave on October 15 against 16 tenants in the policy, national security, trade, and critical-mineral sectors — most of which run no ConnectWise products. Those attempts failed, but the target list reads like deliberate selection, not opportunistic MSP abuse.

What happened

ConnectWise Cloud Backup is an MSP backup service that holds broad Microsoft 365 and Google Workspace access. With its credential, the actor obtained Microsoft Graph tokens inside customer tenants and, in some, went further: a related ConnectWise Cloud Management - MS Teams app added itself to the Global Administrator role and then minted new client secrets on other enterprise apps — a backdoor that survives a password reset.

Timeline (UTC)

  • Oct 13–14: Password spray against four law-firm tenants from 144.172.64[.]128; two accounts locked out.
  • Oct 15, 01:58 onward: In ~50 monitored tenants, Cloud Management service principals self-assigned directory roles, mostly Exchange Administrator.
  • Oct 15, 03:44–03:49: In one tenant, the Teams app granted itself Global Administrator and set new secrets to expire in 2028.
  • Oct 15, 06:13–08:34: The app authenticated from 144.172.64[.]128 in 17 of the first ~290 tenants checked.
  • Oct 16, 19:00: 162 confirmed tenants.

Indicators

From Huntress:

IP:            144.172.64[.]128 (AS14956, RouterHosting)
App IDs:       506e08f9-6e9a-4da4-942b-a099a03644ae  (Cloud Backup / SkyKick)
               24205314-2b89-4e07-a2a4-579e898a5640  (Cloud Management - MS Teams)
User-Agents:   curl/7.88.1 (spray), Python-urllib/3.12 (credential changes)

What to do today

  1. Disable, don't delete, the Cloud Backup service principal — set "Enabled for users to sign-in" to No. Deleting it removes consent and complicates investigation.
  2. Disable other ConnectWise and SkyKick apps you cannot verify. Note: disabling stops new tokens, but issued tokens stay valid for up to ~90 minutes, and revoking user sessions does not end service-principal access.
  3. Audit app credentials added since October 13. Review client secrets and certificates on enterprise apps and app registrations; remove any you did not create — including Huntress Security Platform if you use Huntress.
  4. Strip unauthorized directory roles the apps granted themselves, especially Global Administrator and Privileged Authentication Administrator.
  5. Hunt in Entra logs. In sign-in logs, open the Service principal sign-ins tab and filter by App ID 506e08f9-6e9a-4da4-942b-a099a03644ae for sign-ins outside Microsoft/Azure ranges. In audit logs, look for "Add member to role," "Update application," and "Add service principal credentials" events. Do not re-enable until ConnectWise confirms its credentials are reset.

Context

This is the same play as the Salesforce OAuth-token thefts of this year: compromise one widely-consented third-party app and inherit its blast radius across every customer tenant. The default sign-in view hides service-principal activity, so the attack runs where few admins look. ConnectWise says it shut off Cloud Backup access until further notice and has no evidence that partner backup data was taken; the investigation is ongoing.

Related stories