Compromised ConnectWise Cloud Backup Credential Used to Sign In to 173 Microsoft 365 Tenants, Huntress Says

A credential belonging to ConnectWise Cloud Backup, the product formerly known as SkyKick, is being used by an unknown attacker to get into customers' Microsoft 365 environments. Security firm Huntress has confirmed unauthorized sign-ins in 173 partner and customer tenants. As of 19:00 UTC on Oct. 16, its own published tally was 162.

The product is built for managed service providers, which use it to back up client data in Microsoft 365 and Google Workspace. To do that job, the app holds broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed.

What Huntress observed

On Oct. 15, between 06:13 and 08:34 UTC, the app's identity signed in to customer tenants from 144.172.64[.]128, a hosting provider address, and received Microsoft Graph access tokens. Legitimate traffic from the app comes from Azure private IP space, Huntress said.

Huntress researcher Jonathan Semon said the actor moved through tenants in sorted GUID order, a few seconds apart. That, he said, points to a script working from a target list.

The credential type was a client assertion, which Huntress says means it lives in the vendor's own tenant. "Nothing a customer did in their environment could have produced it," the firm wrote. The authentication itself is recorded in Microsoft's sign-in logs in each affected tenant.

The same IP address was seen password spraying four law firm tenants on Oct. 13 and 14, using scripted OAuth2 token requests. Two accounts were locked out by Microsoft's smart lockout. Huntress said it saw no successful user sign-ins from that address in its telemetry.

Privilege escalation in at least one tenant

In at least one partner tenant, Huntress found a separate ConnectWise app, the ConnectWise Cloud Management app for Microsoft Teams, adding itself to the Global Administrator role. A Python script then added new client secrets to two other applications in that tenant: an MSP management application and Huntress's own Huntress Security Platform app.

Semon said those are trusted, privileged tools. A credential added to an MSP management application can extend access beyond a single tenant, because such apps are often consented into the MSP's customers' tenants. A credential added to a security tool's app gives the holder whatever that tool is permitted to do.

That means rotating the original compromised credential may not close the door in every tenant where the attacker got that far.

ConnectWise's position

ConnectWise has acknowledged the incident on its Trust Center advisory page and confirmed the IP address is associated with unauthorized activity. The company said it has started incident response and that containment measures are in place.

Its preliminary findings, the company said, "indicate no evidence that partner backup data has been compromised." ConnectWise said engineering teams are still analyzing the scope of the activity. It also cautioned that the presence of its published indicators of compromise does not by itself confirm unauthorized activity.

Huntress's description of the app's capabilities is a different matter from that statement. Semon said an attacker holding the tokens can read the same mailboxes, files and directory data the backup service can. Whether anyone actually did so is not established in what either company has published.

What administrators are being told

Huntress told affected organizations to disable the application, ID 506e08f9-6e9a-4da4-942b-a099a03644ae, in the Entra Admin Center. It said it has taken proactive measures for impacted customers of its identity threat detection service and is contacting them by phone.

Guardz, another security provider, said it has contacted every customer with a ConnectWise application installed. It is automatically disabling the app in any tenant where activity from the listed IP addresses appears, or where a ConnectWise or SkyKick app has assigned itself a directory role. Guardz is also urging MSPs to audit their Entra ID environments immediately.

Huntress said the actor is not limited to the tenants confirmed so far, because the credential works against every tenant in which the app is consented. Its blog post says it will keep updating as the investigation continues.

Open questions

Neither ConnectWise nor Huntress has said who is behind the campaign. ConnectWise has not said how the credential was obtained. The company has also not said whether its backup-data finding will hold as the investigation proceeds, or when the full scope of affected tenants will be known.