Attackers abused a compromised vendor credential for ConnectWise Cloud Backup, the service formerly known as SkyKick. With it, they requested access tokens inside customer Microsoft 365 tenants. No user password was needed, and no MFA prompt appeared.
For Canadian managed service providers (MSPs) and their clients, this is a supply chain problem. The backup service itself is suspended. Meanwhile, every tenant that ever consented to the app needs a review. Here is what happened, and what to do this week.
What Happened in the ConnectWise Cloud Backup Incident
According to Huntress, the app’s identity signed in to customer tenants on October 15. The sign-ins came from 144.172.64[.]128, a hosting provider address. They then received Microsoft Graph access tokens.
That is not normal behaviour. Legitimate traffic for the app comes from Azure private IP space. By October 16, Huntress had confirmed unauthorized sign-ins in 162 tenants. Later, it found almost 1,000 Entra tenants with sign-in activity from that address. More than 300 of those succeeded.
In one tenant, the activity went further. A second app, ConnectWise Cloud Management for Microsoft Teams, made itself a Global Administrator. Then it added new client secrets to two other applications. One of them was a Huntress app. Those secrets were set to expire in 2028.
Huntress also saw a second, targeted wave on October 15. It hit 16 tenants in policy, national security, trade and critical mineral sectors. However, those attempts failed, mostly because the app was not present.
Why App-Only Access Skips MFA
This part matters for every Microsoft 365 admin. A backup app needs broad rights to mail, OneDrive, SharePoint, Teams and directory data. So when you consent to ConnectWise Cloud Backup, you trust the vendor’s identity.
Sophos X-Ops explains the core issue. The attacker authenticated as the application itself. Therefore, no user password and no MFA were involved. Anyone holding that credential can request tokens in every tenant that granted consent.
Sophos also describes the sweep. It ran from a single virtual private server for about 96 minutes. Tenants were hit in strict ascending GUID order. In addition, the list included tenants with no active backup subscription. In other words, dormant consents were exposed too.
Notably, some access leaves no trace. Huntress warns that Microsoft Graph directory reads produce no audit record. As a result, a clean audit log does not prove a clean tenant.
What ConnectWise Has Done So Far
The vendor’s Trust Center advisory gives the timeline. ConnectWise says it discovered the issue on October 14. Then, at 07:00 UTC on October 17, it disabled seven application identities. It also revoked the certificates behind the affected connections.
As a precaution, ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management. Scheduled backups, archive access and restores are unavailable. Still, the company says existing archives remain encrypted, isolated and preserved. It reports no sign that those archives were compromised.
However, two caveats stand out. First, previously issued tokens may stay usable until they expire. Second, disabling the apps does not undo changes already made inside a tenant. ConnectWise also says it cannot see into customer tenants. So the tenant review is your job.
As of its October 20 update, ConnectWise had no restoration time. It plans to restore services in controlled phases.
Your First 24 Hours: A ConnectWise Cloud Backup Checklist
Act now, even if you see nothing unusual. Here are the key steps from Huntress and ConnectWise:
- Disable, do not delete. In the Entra admin center, find Application ID
506e08f9-6e9a-4da4-942b-a099a03644ae. Set “Enabled for users to sign-in” to No. - Check related apps. Search for “ConnectWise” and “SkyKick”. Then disable any Cloud Management app you cannot verify.
- Preserve logs first. Export audit and sign-in records now. Entra Free keeps them for only seven days.
- Use the right tab. Review Service principal sign-ins, not the default User sign-ins tab. Look for
144.172.64[.]128,.99and.60. - Hunt for planted secrets. Review credentials on all app registrations added since October 13.
- Review roles and consent. Remove any directory role you did not grant, especially Global Administrator.
- Check mail rules. Look for new forwarding, hidden inbox rules and transport rule changes.
Also review Conditional Access exclusions. If a policy excludes the app, attacker traffic may slip past it.
Close the Backup Gap
Here is the part many teams forget. While ConnectWise Cloud Backup is down, no new recovery points exist. Your Microsoft 365 data keeps changing, yet nothing protects it.
So check the last successful backup date for each client. Then decide whether you need a temporary second backup. For regulated clients, that gap could become a compliance question. Likewise, loop in your privacy lead early if you find signs of data access.
Finally, do not reconnect anything early. Huntress and ConnectWise both say to wait for formal restoration instructions.
Lessons for Canadian MSPs and Their Clients
This incident fits a pattern we keep seeing. Attackers go after trusted tools that already hold broad access. We saw the same theme with remote support software in the BeyondTrust zero-day.
First, inventory every third-party app in your tenants, including old ones. Next, remove consents you no longer use. Then limit who can add credentials to applications. Huntress also suggests Entra controls such as app management policies and shorter credential lifetimes.
For MSPs, one more step matters. A foothold in your own tenant can lead to every client you manage. Therefore, review your management and security tools first.
Bottom line: treat any ConnectWise Cloud Backup tenant as a possible exposure until you prove otherwise. Preserve the logs today, before they roll off.
ConnectWise, SkyKick, Microsoft 365, Entra ID, MSP security, Supply chain attack, Canadian cybersecurityconnectwise-cloud-backup-incident
No comment