THREAT actors abused a compromised vendor API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 environments, affecting more than 300 Microsoft Entra tenants. Huntress’ investigation indicates the primary ConnectWise Cloud Backup application (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) authenticated to harvest Graph tokens from the IP 144.172.64[.]128.
The attackers used a client assertion credential stored in the vendor’s tenant, meaning customers could not have triggered this from their own environments. ConnectWise temporarily suspended Cloud Backup, SaaS Security and Cloud Management services to replace application credentials, after confirming the unauthorized activity.
Investigators found post‑compromise persistence in at least two customer environments: around 03:45 UTC on 15 October, a second vendor app, ConnectWise Cloud Management – MS Teams, assigned itself Global Administrator, and a Python script attached new client secrets to existing third‑party applications inside those tenants. In one partner environment, a secret exiring in 2028 was added to the Huntress Security Platform application and used seven times before removal.
The attacker’s technique exploited application‑only sign‑ins (which bypass MFA) to maintain footholds even after credentials are reset. Across more than 10,000 monitored environments, Huntress identified nearly 1,000 Entra tenants with sign‑in attempts from the attacker’s IP, resulting in over 300 successful authentications and access to emails, SharePoint files, Teams chats and directory records via six ConnectWise/ SkyKick enterprise applications.
Administrators are advised to audit credentials, disable affected enterprise applications, search Entra logs for 144.172.64[.]128 traffic in the relevant window, and remove any unauthorized Global Administrator or Exchange Administrator roles before re‑enabling tools.