Attackers are abusing a compromised credential for ConnectWise Cloud Backup to sign in to Microsoft 365 tenants, according to security researchers. Huntress said it confirmed unauthorized sign-ins in 173 partner and customer tenants. ConnectWise Cloud Backup, formerly SkyKick, is a cloud backup service for managed service providers, and the application carries broad permissions for mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant where it is installed.
The credential was used to obtain Microsoft Graph tokens from IP 144.172.64.128 on October 15, between 06:13 and 08:34 UTC. Huntress described the activity as moving through tenants in sorted GUID order a few seconds apart, which points to a script working from a target list. Todyl similarly detected an unauthorized party authenticating to Microsoft Graph as the ConnectWise Cloud Backup application, inheriting the app's existing read/write access to mail, files, and Teams chats. In at least one partner tenant, a separate ConnectWise app for Microsoft Teams assigned itself Global Administrator and added new client secrets to an MSP management app and Huntress's own application, extending potential access.
ConnectWise has closed Cloud Backup application access until further notice and said it found no evidence that partner backup data was compromised. The company published indicators of compromise, including filtering sign-in logs by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and reviewing activity from IPs outside Azure ranges, with suspicious IP 144.172.64.128. Researchers recommend disabling the app until ConnectWise confirms all credentials have been reset, enabling Microsoft Graph activity logs, auditing for new credentials added since October 13, and checking Entra audit logs. They also warn that revoking user sessions does not end access; disabling the app stops new tokens, but existing tokens can remain valid for up to 90 minutes.