Attacker used the ConnectWise Cloud Backup app to access Microsoft 365 tenants

An attacker used a compromised credential for ConnectWise’s multi-tenant Cloud Backup app (formerly SkyKick) to sign in to customer tenants as the app itself, bypassing MFA and user Conditional Access. By Oct 17, Huntress had seen sign-ins from the attacker’s IP in almost 1,000 tenants, over 300 of them successful.

Editor: Austin Simas
Updated: Oct 19, 6:00 a.m. ET
Corrections: None
CVE: None
Log retention: 7 days on free tenants
Vendors: ConnectWise, Microsoft

What to do

5 steps

1Disable, don’t delete, every ConnectWise and SkyKick app in Entra until ConnectWise confirms all credentials have been reset.
2Export Entra logs now. Free tenants keep only 7 days.
3Check Service principal sign-ins, not User sign-ins, for app ID from or any non-Microsoft IP.
4Search audit logs since Oct 13 for role, app and credential changes made by these apps, and remove any that weren’t authorized.
5Don’t rely on revoking user sessions, which won’t cut the app off; disabling it does once issued tokens expire within 90 minutes, Todyl says.

Affected and fixed versions

Not applicable: cloud service.

Indicators

IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
IP address		Attacker IP
App ID		ConnectWise Cloud Backup
App ID		ConnectWise Cloud Management
App ID		ConnectWise Cloud Management - MS Teams
App ID		ConnectWise Cloud Management - Exchange Online
App ID		ConnectWise Cloud Management - MS Graph
App ID		ConnectWise Cloud Management - Partner Center
App ID		ConnectWise Cloud Management - SharePoint Online
User agent		Seen on credential changes and, per ConnectWise, on suspicious sign-ins; low fidelity on its own
User agent		Seen on suspicious sign-ins, per ConnectWise; low fidelity on its own
User agent		Seen on the password spray; low fidelity on its own, but useful with the IP

IP addressAttacker IP: Network
App IDConnectWise Cloud Backup
App IDConnectWise Cloud Management
App IDConnectWise Cloud Management - MS Teams
App IDConnectWise Cloud Management - Exchange Online
App IDConnectWise Cloud Management - MS Graph
App IDConnectWise Cloud Management - Partner Center
App IDConnectWise Cloud Management - SharePoint Online
User agentSeen on credential changes and, per ConnectWise, on suspicious sign-ins; low fidelity on its own
User agentSeen on suspicious sign-ins, per ConnectWise; low fidelity on its own
User agentSeen on the password spray; low fidelity on its own, but useful with the IP

Timeline

Oct 13–14Four law firm tenants are password-sprayed from the attacker IP.
Oct 14ConnectWise’s Cloud Management app for Microsoft Teams gives itself Global Administrator in one tenant and adds new secrets to two other apps.
Oct 15The Cloud Backup app signs in to customer tenants from the attacker IP in a scripted sweep and gets Microsoft Graph tokens.
Oct 16Huntress and Todyl publish, and ConnectWise posts an advisory.
Oct 16Huntress confirms unauthorized sign-ins in 162 tenants.
Oct 17ConnectWise takes Cloud Backup offline.
Oct 17Huntress has high confidence the attacker also abused ConnectWise’s Cloud Management apps for Exchange Online, Teams and SharePoint Online.
Oct 17ConnectWise disables seven app identities.
Oct 17Huntress counts almost 1,000 tenants with sign-ins from the attacker IP, over 300 of them successful.
Oct 17ConnectWise says the shared Cloud Backup credentials are no longer valid, but access set up through other identities still needs review.
Oct 17ConnectWise’s SaaS Security and Cloud Management services are also offline as a precaution.

Sources

HuntressPrimary source huntress.com
TodylPrimary source todyl.com
BleepingComputerReporting bleepingcomputer.com
MicrosoftPrimary source learn.microsoft.com

Corrections

No corrections to this story.

Spotted an error? Tell us and we’ll correct it.