Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services.

Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications.

ConnectWise said in its October 17 update, supplied for this report, that investigators identified unauthorized access to application identities within its Cloud Backup environment.

Hackers Use ConnectWise SkyKick Credentials

The company reported no indicators that stored partner backup data had been compromised and said existing archives remained unaffected by the service interruption.

The affected service, formerly SkyKick, provides cloud backup and recovery for managed service providers. Its application requires extensive permissions to protect Microsoft 365 mailboxes, OneDrive, SharePoint, Teams, and directory information.

According to Huntress researcher Jonathan Semon, attackers used the compromised application credential to obtain Microsoft Graph tokens from hosting-provider address 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.

Requests progressed through tenants in sorted identifier order, seconds apart, suggesting automated targeting. The stolen credential allowed authentication as the trusted application, inheriting permissions already approved within each tenant.

Exposure therefore extends beyond confirmed victims to other organizations where the application has been consented. In one partner tenant, Huntress observed a second application, ConnectWise Cloud Management – MS Teams, assign itself Global Administrator privileges before adding client secrets to two other applications.

Those targets included an MSP management application and a partner-specific Huntress Security Platform application. The added secrets, configured to expire in 2028, created potential persistence independent of the originally compromised credential.

The changes occurred roughly two and a half hours before the observed public-IP authentications. Huntress has not established that both activity sequences involved the same operator. A logged private IPv6 address also cannot identify the operator because legitimate traffic shares that infrastructure.

Data theft remains unconfirmed. Huntress cautioned that the absence of visible mailbox or file activity does not establish safety, particularly where directory reads lack audit visibility.

Huntress advises disabling, rather than deleting, ConnectWise Cloud Backup application 506e08f9-6e9a-4da4-942b-a099a03644ae and Cloud Management – MS Teams application 24205314-2b89-4e07-a2a4-579e898a5640. Other ConnectWise applications should also undergo review.

Administrators should inspect Microsoft Entra service principal sign-in logs for suspicious authentication, including 144.172.64[.]128, and investigate unexpected directory-role assignments or application modifications.

Crucially, disabling vendor applications does not remove secrets planted elsewhere. Organizations must review client secrets and certificates across application registrations and enterprise applications, remove unauthorized credentials added since October 13, and revoke unexpected privileges.

Affected applications should remain disabled until ConnectWise confirms credential resets. Backup interruptions require operational planning, but existing stored backups are not deleted.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team