ConnectWise SkyKick credential abuse exposes 162 M365 tenants to broad backup app permissions
Huntress confirms attackers abused vendor credentials to access Microsoft 365 data across 162 tenants using broad backup application permissions.
Key points
- Huntress confirmed unauthorized sign-ins in 162 Microsoft 365 tenants using compromised ConnectWise SkyKick credentials.
- The attacker used client assertions from a hosting provider IP to obtain Microsoft Graph access tokens.
- Any organization with the ConnectWise Cloud Backup app installed is potentially affected by this incident.
Attackers gained broad read and write access to Microsoft 365 mailboxes, files, and directory data by abusing compromised vendor credentials. According to Huntress, the threat actor obtained Microsoft Graph tokens using the ConnectWise SkyKick application identity, allowing them to access sensitive customer data without needing individual user passwords.
How it unfolded
- October 13 to 14: Password spraying occurred against four law firm tenants from IP 144.172.64.128; two accounts were locked out by smart lockout.
- October 15: The attacker used the compromised app identity to sign in to customer tenants and receive Microsoft Graph access tokens.
- October 16: Huntress confirmed unauthorized sign-ins in 162 tenants by 19:00 UTC, noting the apps remained enabled.
Who is affected
Any organization that has installed the ConnectWise Cloud Backup application is at risk. The compromised credential works against every tenant where the app was consented, meaning the attacker is not limited to the 162 confirmed cases. Huntress observed the actor moving through tenants in sorted GUID order, suggesting automated scripting against a target list.
The fix
No patch or fix has been confirmed yet. ConnectWise has acknowledged the incident and confirmed the IP address is associated with unauthorized activity. Huntress advises disabling the ConnectWise SkyKick apps in Microsoft 365 tenants immediately and checking logs for the specific application IDs provided in their report.
What made it possible
This incident illustrates the risk of third-party applications holding persistent, high-privilege access to enterprise environments. When a vendor application is granted broad permissions to perform backups, its credentials become a high-value target. If those vendor-held credentials are compromised, attackers bypass local security controls entirely. Teams usually monitor for anomalous source IPs for service principals, as legitimate traffic should originate from known cloud ranges, not generic hosting providers.
What to do and how to stay safe: ConnectWise
- Review Microsoft Entra sign-in logs for the specific ConnectWise SkyKick application IDs mentioned in Huntress reports.
- Disable the ConnectWise Cloud Management apps for Exchange, Teams, and SharePoint in your tenant immediately.
- Check for unauthorized access tokens issued to these applications from non-Azure IP addresses.
- Monitor for alphabetical targeting patterns or scripted GUID enumeration in your audit logs.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attacker access the Microsoft 365 tenants?
The attacker used compromised vendor credentials via client assertions to obtain Microsoft Graph access tokens.
Which specific applications were abused by the threat actor?
ConnectWise Cloud Management apps for Exchange Online, MS Teams, and SharePoint Online were abused.
Is there a confirmed fix for this vulnerability?
No fix has been confirmed yet; vendors advise disabling the affected apps immediately.
