ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

A compromised credential belonging to ConnectWise Cloud Backup has allowed an unauthorized actor to access customer Microsoft 365 tenants. The attacker utilized a client assertion from the vendor's tenant to obtain Microsoft Graph tokens, bypassing user-level authentication and MFA. While 162 tenants have confirmed unauthorized sign-ins, the breach potentially affects any organization where the app is installed.
The activity evolved from initial password spraying to more sophisticated persistence techniques. In at least one instance, the attacker escalated privileges to Global Administrator and planted new client secrets in other trusted management and security applications to maintain access. It remains uncertain exactly how much data was exfiltrated, as directory reads through Microsoft Graph do not leave an audit trail. Organizations are advised to disable the affected applications and audit their Entra ID credentials for unauthorized additions.

* ConnectWise Cloud Backup (formerly SkyKick) is a cloud-based backup service for Microsoft 365 and Google Workspace.
* Unauthorized sign-ins to customer Microsoft 365 tenants occurred on October 15 from IP address 144.172.64[.]128.
* Sign-ins used a client assertion credential residing in the vendor's own tenant.
* Unauthorized activity was confirmed in 162 tenants as of 19:00 UTC on October 16.
* On October 13 and 14, password spraying against four law firm tenants originated from 144.172.64[.]128.
* In one customer tenant, the ConnectWise Cloud Management app for Microsoft Teams assigned itself the Global Administrator role.
* In the same tenant, a Python script added new client secrets to a Huntress application and an MSP management application.
* The actor moved through tenants in sorted GUID order between 06:13 and 08:34 UTC on October 15.
* ConnectWise has acknowledged the incident and confirmed the associated IP address.
* Affected entities include any organization with the application installed and consented.

The strongest version of this narrative is a critical security alert detailing a supply-chain compromise where a trusted vendor's high-privilege credentials were weaponized to penetrate downstream customers. It provides specific technical indicators and actionable mitigation steps.
However, the structure follows a classic vendor-led threat intelligence pattern. By highlighting the specific vulnerability of the ConnectWise app and then detailing the "persistence" found within its own security platform, Huntress creates a narrative where its own tool is a victim of the breach, thereby validating its presence and necessity in the tenant. The urgency is driven by the "invisible" nature of Graph reads, which leverages a known technical limitation to create a high-pressure decision frame for the reader.
Patterns detected: ARC-0052 Authority Game, ARC-0021 Fear Appeal
The root cause is the systemic risk of "over-permissioning" in the MSP model. The industry relies on granting broad, app-only permissions to third-party tools for convenience, creating single points of failure that grant attackers "god-mode" access without triggering traditional user-based alerts.
The implication is a diminishing sense of agency for the end-user; the security of a tenant is no longer determined by the tenant's own policies, but by the weakest link in their vendor chain.
Bridge Questions:
1. If directory reads leave no audit trail, how can any organization truly verify the extent of a data breach in a Graph-based environment?
2. What alternative architectures exist for backup services that do not require broad, permanent app-only permissions?
Counterstrike Scan: A coordinated campaign would use a real breach to scare MSPs into switching security vendors by framing the current ecosystem as fundamentally broken. While this contains a call to action for a specific tool, it remains largely a technical advisory; the alignment is minimal.