Disable ConnectWise SkyKick Apps in M365 Tenants Immediately
Huntress confirms attackers are using stolen vendor credentials to access Microsoft 365 data, requiring immediate app revocation and log review.
Key points
- Huntress confirmed unauthorized sign-ins in 162 Microsoft 365 tenants by October 16.
- Attackers used stolen ConnectWise SkyKick credentials to obtain Microsoft Graph access tokens.
- The malicious activity originated from a single hosting provider IP address on October 15.
Huntress reported that threat actors are abusing compromised vendor credentials associated with ConnectWise SkyKick to access Microsoft 365 environments. The security firm confirmed unauthorized sign-ins in 162 tenants by 19:00 UTC on October 16. These breaches allow attackers to read mailboxes, files, and directory data using the broad permissions granted to the backup service.
The risk
The attacker obtained Microsoft Graph access tokens by authenticating with the application’s client assertion credential. This credential resides in the vendor’s own tenant, meaning customers could not have caused the compromise through their own configurations. Huntress observed the actor moving through tenants in sorted GUID order, suggesting the use of a script working from a predefined target list.
Who is exposed
Any organization with the ConnectWise Cloud Backup app installed is potentially exposed. Because the compromised credential works against every tenant where the app has been consented, the threat is not limited to the specific tenants Huntress has already confirmed. The researcher noted an affinity for alphabetical targeting, with some victims starting with the letter "A," which may help teams prioritize their investigations.
Cost and compliance
ConnectWise has acknowledged the incident on its website and confirmed the IP address is associated with unauthorized activity. Huntress stated that the affected applications, including those for Exchange Online, MS Teams, and SharePoint Online, do not appear to have been disabled by ConnectWise at the time of reporting. Todyl also reported on this incident.
Our take on the response
Teams should immediately disable the ConnectWise SkyKick applications in their Microsoft Entra Admin Center. This action aligns with Huntress advice to disable the apps now. Monitoring for residual access is critical until a confirmed fix is provided.
What defenders should look for
Security operations teams should examine Microsoft Entra sign-in logs for authentications originating from unfamiliar IP addresses, particularly datacenter ranges. Look for applications with broad directory or mailbox permissions generating unexpected activity. Check for scripted behavior, such as rapid sequential logins or consistent user-agent strings. If anomalies are found, isolate affected accounts and review audit logs for data exfiltration or permission changes.
Background: Threat actors
Small businesses must treat threat actors as automated scripts rather than targeted spies. Focus on patching, least privilege, and monitoring. Ask your IT provider about specific detection rules and incident response plans to reduce mean time to detect and limit damage during an intrusion.
Read the full guide: Threat Actors: Practical Defense Strategies for Small Businesses
What to do and how to stay safe: ConnectWise
- Review Microsoft Entra sign-in logs for the ConnectWise SkyKick application and disable it if unauthorized activity is detected.
- Check for new application registrations or permission grants made during the window of the compromise.
- Monitor for unusual data access patterns, such as bulk downloads of mailboxes or SharePoint files.
- Once the vendor provides an update, verify the new credentials before re-enabling the service.
Step-by-step guide: Multi-Factor Authentication Fatigue: Why Users Click Yes Too Fast
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attacker gain access to these Microsoft 365 tenants?
The attacker used a stolen client assertion credential belonging to the ConnectWise SkyKick vendor application.
Which Microsoft 365 services were targeted in this breach?
Huntress identified abuse of applications connected to Exchange Online, MS Teams, and SharePoint Online.
Is there a patch available for this vulnerability?
No fix has been confirmed yet; Huntress advises disabling the apps until the vendor resolves the issue.
