ConnectWise has shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after hackers accessed application identities and compromised Microsoft 365 tenants. Huntress, a managed cybersecurity and threat detection platform, said it had identified at least 162 compromised tenants in its environment. Microsoft has also confirmed malicious activity involving the service.
What happened
In a security advisory, ConnectWise said it had identified unauthorized access to application identities within the Cloud Backup environment, and it shut down application access for its partners and clients. The service was previously known as SkyKick Cloud Backup.
ConnectWise recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.
Later on the same day, Huntress confirmed the concerns, saying it had identified at least 162 compromised tenants in its environment. In a post today, Microsoft also confirmed malicious activity involving the Cloud Backup service, saying it identified unauthorized authentication attempts from an IP address on October 15.
How it was done
Microsoft Threat Intelligence characterized the incident as an active supply-chain attack. Its assessment is that the attacker likely abused existing permissions, including Directory.ReadWrite.All. That means the path into customer environments ran through the trust already granted to the vendor application, rather than through end user credentials.
What to check
If you run Microsoft 365 and grant third party applications directory level access, these checks are worth running now.
Inventory third party service principals
In the Entra admin center, open Enterprise applications and filter to applications you did not create. Export the list and compare it against the vendors you knowingly onboarded. An application nobody can account for, or one owned by a supplier you no longer use, is a bad result.
Review who holds Directory.ReadWrite.All
Use Graph PowerShell with Get-MgServicePrincipal and Get-MgServicePrincipalAppRoleAssignment to list application permissions per service principal. Flag any non Microsoft app holding directory write scopes. Treat broad write permissions granted for a read only business function as a finding.
Hunt service principal sign-ins
In Entra sign-in logs, switch to the service principal sign-ins tab and pivot on IP address and ASN over the last few months. Look for authentications from hosting ranges or countries that do not match the vendor. Repeated failures followed by a success is the pattern to chase.
Look for new credentials on applications
Check the audit log for events such as Update application, Add service principal credentials and Add owner. A certificate or client secret added outside a change window, especially one with a long expiry, should be revoked and investigated.
Check what the app touched
In Microsoft Purview audit search, query mailbox and directory activity attributed to the application identity. Mass mailbox access, role assignments or new user objects created by a backup application are out of character for that workload.
Revoke and rotate deliberately
Remove consent for any application you cannot justify, delete its credentials, then revoke active tokens with Revoke-MgUserSignInSession for affected users. Confirm afterwards that the app can no longer authenticate before you consider the item closed.