Compromised ConnectWise Cloud Backup credential lets attackers sign in to 173 Microsoft 365 tenants

Huntress observed attackers abusing a compromised Microsoft 365 OAuth credential for ConnectWise Cloud Backup, formerly SkyKick, to sign in to 173 partner and customer tenants. The credential works against every tenant the app is consented in, letting attackers obtain Microsoft Graph tokens and reach mailboxes, files, and directory data. In at least one tenant, a ConnectWise app added itself to the Global Administrator role and created new client secrets. Token acquisition came from a single IP on October 15, moving through tenants in sorted order. ConnectWise closed Cloud Backup access until all credentials are reset, and issued tokens stay valid for up to 90 minutes.

Check

If you use ConnectWise Cloud Backup, keep the application disabled until credentials are reset, enable Microsoft Graph activity logs, and audit for credentials added since October 13.

Affected

Microsoft 365 tenants that consented to the ConnectWise Cloud Backup app could be accessed with a compromised credential, exposing mailboxes, files, and directory data to attackers.

Fix

Disable the affected ConnectWise applications, review service principal sign-ins for application ID 506e08f9 and IP 144.172.64.128, revoke added secrets, and check for apps granting themselves admin roles.