ConnectWise Cloud Backup credential abused in M365 attacks

Attackers are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to the M365 tenants that have consented to the app. Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16 — and warns the credential works against every tenant where the app is installed, so the real figure is higher. If you run ConnectWise or SkyKick apps in M365, treat this as active now.

The primary source is Huntress's writeup, ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks by Jonathan Semon, corroborated by Todyl and by Microsoft, which flagged it on X as an active supply-chain attack. The Hacker News put the tenant count higher, at 173; we use Huntress's timestamped 162. No group has claimed responsibility, and no CVE is involved — this is abuse of a trusted vendor's OAuth app, not a software flaw.

What happened

ConnectWise Cloud Backup is an MSP backup service that holds broad Microsoft 365 and Google Workspace access. With its credential, the actor obtained Microsoft Graph tokens inside customer tenants and, in some, went further: a related ConnectWise Cloud Management - MS Teams app added itself to the Global Administrator role and then minted new client secrets on other enterprise apps — a backdoor that survives a password reset.

Timeline (UTC)

• Oct 13–14: Password spray against four law-firm tenants from 144.172.64[.]128; two accounts locked out.
• Oct 15, 01:58 onward: In ~50 monitored tenants, Cloud Management service principals self-assigned directory roles, mostly Exchange Administrator.
• Oct 15, 03:44–03:49: In one tenant, the Teams app granted itself Global Administrator and set new secrets to expire in 2028.
• Oct 15, 06:13–08:34: The app authenticated from 144.172.64[.]128 in 17 of the first ~290 tenants checked.
• Oct 16, 19:00: 162 confirmed tenants.

Indicators

From Huntress:

IP:            144.172.64[.]128 (AS14956, RouterHosting)
App IDs:       506e08f9-6e9a-4da4-942b-a099a03644ae  (Cloud Backup / SkyKick)
               24205314-2b89-4e07-a2a4-579e898a5640  (Cloud Management - MS Teams)
User-Agents:   curl/7.88.1 (spray), Python-urllib/3.12 (credential changes)

What to do today

1. Disable, don't delete, the Cloud Backup service principal — set "Enabled for users to sign-in" to No. Deleting it removes consent and complicates investigation.
2. Disable other ConnectWise and SkyKick apps you cannot verify. Note: disabling stops new tokens, but issued tokens stay valid for up to ~90 minutes, and revoking user sessions does not end service-principal access.
3. Audit app credentials added since October 13. Review client secrets and certificates on enterprise apps and app registrations; remove any you did not create — including Huntress Security Platform if you use Huntress.
4. Strip unauthorized directory roles the apps granted themselves, especially Global Administrator and Privileged Authentication Administrator.
5. Hunt in Entra logs. In sign-in logs, open the Service principal sign-ins tab and filter by App ID 506e08f9-6e9a-4da4-942b-a099a03644ae for sign-ins outside Microsoft/Azure ranges. In audit logs, look for "Add member to role," "Update application," and "Add service principal credentials" events. Do not re-enable until ConnectWise confirms its credentials are reset.

Context

This is the same play as the Salesforce OAuth-token thefts of this year: compromise one widely-consented third-party app and inherit its blast radius across every customer tenant. The default sign-in view hides service-principal activity, so the attack runs where few admins look. ConnectWise says it shut off Cloud Backup access until further notice and has no evidence that partner backup data was taken; the investigation is ongoing.