A credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service MSPs knew as SkyKick, is in an attacker's hands and is being used to sign in to customer tenants. Researchers at Huntress say that as of 19:00 UTC on October 16 they had confirmed unauthorized sign-ins in 162 tenants, and ConnectWise has acknowledged the incident and confirmed the attacker's IP address is tied to unauthorized activity.
The access is broad by design. A backup service needs to read mailboxes, OneDrive, SharePoint, Teams and directory data so it can copy them, and write access so it can restore them. Whoever holds the app's credential inherits exactly that, in every tenant where the app is consented, with no user, no device and no MFA prompt involved.
The credential lives in the vendor's tenant, not yours
Huntress says the sign-ins used a client assertion, a type of credential that is stored in the vendor's own Microsoft tenant. Nothing a customer did could have produced it. On October 15, between 06:13 and 08:34 UTC, the app's identity requested Microsoft Graph tokens from 144[.]172[.]64[.]128, a hosting provider address (AS14956, RouterHosting), instead of the Azure private address space its legitimate traffic normally comes from. The actor moved through tenants a few seconds apart, which Huntress reads as a script working from a target list.
The same address had been busy before that. On October 13 and 14 it password-sprayed four law firm tenants using scripted OAuth2 requests with a curl/7.88.1 User-Agent, locking out two accounts. Huntress saw no successful user sign-ins from it.
One tenant shows how fast it escalates
In a single customer tenant, at 03:44 UTC on October 15, the ConnectWise Cloud Management app for Microsoft Teams added itself to the Global Administrator role, then ran a Python script (User-Agent Python-urllib/3.12) that added new client secrets, set to expire in 2028, to two other applications: an MSP management tool and Huntress's own security platform app. The whole sequence took about five minutes. A new secret on an existing app is a durable back door (MITRE ATT&CK T1098.001), and on an MSP management tool it can reach beyond one tenant into that MSP's customers.
Huntress is careful about what it has not established. That activity came about two and a half hours before the first sign-ins from the hosting IP and carried no source address, so the two phases are not tied to the same operator. In the one audit log reviewed in detail there is no sign of mail or file access, but Graph directory reads leave no audit trail, so the current state is tokens issued and nothing visibly taken, not proof that nothing was taken.
Disable the app now, but do not delete it
- In the Entra admin center, open Enterprise applications, find Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae (search "SkyKick" or "ConnectWise Cloud Backup") and set "Enabled for users to sign-in" to No. Deleting it removes consent and forces a re-consent later.
- Do the same for any other ConnectWise or SkyKick app you cannot verify, including the Cloud Management apps (older tenants may show "SkyKick Cloud Manager").
- Remove any directory role, especially Global Administrator, that one of these apps holds and you did not grant.
- Review client secrets and certificates on all enterprise apps and app registrations, security and management tools first, for anything added since October 13.
- Check the Service principal sign-ins tab for the app ID and any address outside Microsoft ranges.
Disabling the app pauses backups but leaves mail, files and existing backups intact. Huntress advises not re-enabling any ConnectWise app until ConnectWise confirms every credential has been reset. It credits Rich Mozeleski, Andrew Brandt, Andrew Kaiser, Dave Kleinatland and Matt Kiely for the investigation.
Indicators
- 144[.]172[.]64[.]128 (AS14956, RouterHosting): password spray and app sign-ins
- 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7: vendor tenant ID on the app's service principal events
- User-Agents Python-urllib/3.12, python-requests/2.31 and curl/7.88.1, low fidelity on their own
Token theft against Microsoft 365 has mostly meant phishing users, as in the point-and-click Entra token tooling we covered in August. This case skips the user entirely. The weakest link is a trusted vendor's app that already holds the keys, which is why rotating that one credential will not be enough for anyone the attacker reached.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.