Remove ConnectWise SkyKick from Microsoft 365 to Stop Credential Abuse in 162 Tenants
Compromised vendor credentials allow attackers to access Microsoft 365 data across many tenants. Users should disable the application immediately to stop unauthorized access.
Key points
- Huntress confirmed unauthorized sign-ins using ConnectWise SkyKick credentials in 162 Microsoft 365 tenants.
- The compromised application identity grants broad permissions to read mailboxes, files, Teams data, and directory information.
- Attackers used the credential from a single hosting provider IP address, targeting tenants in a sorted order starting with the letter A.
Organizations using the ConnectWise Cloud Backup service, formerly known as SkyKick, face immediate risks to their Microsoft 365 data. Huntress, a cybersecurity firm, reported that threat actors are abusing vendor credentials to access customer tenants. The application is designed to back up data, which requires broad permissions to read mailboxes, OneDrive files, SharePoint sites, and Microsoft Teams channels.
Which tenants are at risk?
Any organization that has installed the ConnectWise Cloud Backup application in its Microsoft 365 environment is potentially affected. Huntress stated that the compromised credential works against every tenant where the app has been consented. The firm confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on 16 October. The attackers are not limited to only those confirmed cases, meaning any installation could be targeted.
How are the attackers gaining access?
The threat actors are not hacking individual user passwords. Instead, they are using the application's own identity to authenticate. Huntress explained that the credential type is a client assertion, which resides in the vendor's own tenant. This means customers could not have caused this exposure through their own settings. Attackers use their own tools to sign in as the app, obtaining Microsoft Graph tokens that carry the same broad permissions the backup service normally uses.
What patterns have been observed?
Huntress identified specific behaviours in the attack activity. The unauthorized sign-ins originated from a single hosting provider IP address on 15 October. The attackers moved through tenants in sorted GUID order, with requests arriving a few seconds apart, suggesting the use of automated scripts. The firm noted an affinity for alphabetical targeting, with many of the most interesting victims having names starting with the letter A.
What has the vendor done?
ConnectWise has acknowledged the incident on its website. The company confirmed that the IP address associated with the unauthorized activity is indeed linked to the breach. Huntress noted that the affected applications, including those for Exchange Online, Microsoft Teams, and SharePoint Online, did not appear to have been disabled by ConnectWise at the time of the report.
What affected people can do
Teams usually review Microsoft Entra ID sign-in logs for unusual activity immediately. Check whether the ConnectWise SkyKick application is still active in your tenant and disable it if you do not require instant backup access. Look for any unexpected token requests or administrative changes made during the window of the breach. Be alert for follow-up phishing emails that reference this incident, as attackers often try to exploit confusion to steal additional credentials.
Background: Unauthorized access
The difference between authorized and unauthorized access lies in explicit permission. Authorized access occurs when a system grants entry based on verified identity and defined scope. Unauthorized access happens when an entity enters or acts without this consent, whether through stolen credentials or by exceeding their granted privileges.
Read the full guide: Difference Between Authorized and Unauthorized Access: The Hidden Boundaries
What to do and how to stay safe: ConnectWise
- Review Microsoft 365 sign-in logs for any authentication attempts originating from the IP address 144.172.64.128 or other unfamiliar hosting providers.
- Temporarily disable the ConnectWise Cloud Backup application in your Microsoft Entra admin centre until the vendor provides a secure update or replacement credential.
- Monitor Microsoft Teams, SharePoint, and Exchange Online for any unauthorized data access or configuration changes that occurred in October.
- Educate staff to report any suspicious emails claiming to be from ConnectWise or Microsoft regarding this specific security incident.
Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is my Microsoft 365 tenant affected by this breach?
If you have the ConnectWise Cloud Backup application installed in your tenant, you are potentially affected. Huntress confirmed unauthorized access in 162 tenants.
Did users need to click a link or enter a password?
No. The attackers used the application's own credentials, which are stored in the vendor's tenant. Users did not need to provide their own passwords for this access.
What data can the attackers read?
The compromised credentials allow access to the same data the backup service can read, including mailboxes, OneDrive files, SharePoint content, and directory data.
