Stolen ConnectWise app credentials used against Microsoft 365 tenants
Original title: Attackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
ConnectWise said unknown attackers obtained unauthorized access to seven application identities tied to Cloud Backup, formerly SkyKick. The company found the activity on October 14, disabled the identities on October 17, revoked certificates, and suspended Cloud Backup, SaaS Security, and Cloud Management. Because the applications already held Microsoft 365 permissions, stolen credentials could be used to request Entra ID tokens without customer passwords. Huntress reported sign-ins from 144.172.64.128 and warned that attackers may have planted new application credentials that survive revocation.
Unconfirmed: ConnectWise says it is still investigating how the application credentials were obtained.
- ConnectWise says it has not seen successful activity since the mitigations.
- About 1,000 Entra tenants showed the suspicious IP; roughly 300 sign-ins succeeded.
- A later manual wave against 16 sensitive-sector tenants failed.
- Cloud Backup archives remain offline, encrypted, and, ConnectWise says, unaccessed.
- Huntress says rotating the vendor credential alone does not remove persistence.
Impact: possible access to mail, files, Teams, and directory data
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Review Entra sign-ins from 144.172.64.128 since October 13, including dormant SkyKick links.
- 2.Preserve sign-in and audit logs before changing tenant configuration.
- 3.Look for added application secrets, new apps, and elevated directory roles.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1098.001 Additional Cloud CredentialsT1550.001 Application Access Token
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | ck connections. Look specifically for sign-in activity from 144.172.64[.]128 starting October 13. Before doing anything else, preserve |
From the original article
4 min read at securityaffairs.comAttackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company discovered the incident […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.