Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
Attackers abused compromised ConnectWise Cloud Backup (formerly SkyKick) application credentials to sign in to Microsoft 365 customer tenants. Huntress researcher Jonathan Semon reported unauthorized authentications across 162 tenants as of 19:00 UTC on October 16, using Microsoft Graph tokens from 144.172.64.128. ConnectWise disabled application access, interrupting backups, and said stored partner archives showed no compromise. In one tenant, ConnectWise Cloud Management – MS Teams assigned itself Global Administrator and added client secrets expiring in 2028; data theft is unconfirmed.
- Unauthorized sign-ins hit 162 Microsoft 365 tenants via ConnectWise Cloud Backup.
- Attackers obtained Graph tokens from 144.172.64.128 on October 15 using Python clients.
- One tenant saw Global Administrator assignment and client secrets set to expire in 2028.
- Stored partner backups were not reported compromised; data theft remains unconfirmed.
- Huntress advises disabling the apps and removing secrets added since October 13.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1098.003 Account Manipulation: Additional Cloud RolesT1098.001 Account Manipulation: Additional Cloud Credentials
- Vendors
- ConnectWiseMicrosoftSkyKick
- Organizations
- ConnectWiseHuntressMicrosoft
From the original article
3 min read at gbhackers.com
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services. Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications. ConnectWise said in its October 17 update, supplied for […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.