ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

A compromise of ConnectWise Cloud Backup (formerly SkyKick) credentials has allowed an unauthorized actor to access numerous Microsoft 365 tenants. The attacker utilized a hosting provider IP address to obtain Microsoft Graph tokens, enabling them to read and potentially modify mailboxes, OneDrive, SharePoint, and Teams data. While the primary wave of activity was scripted and followed a sorted GUID order, a second, more targeted wave focused on critical infrastructure and national security sectors.
In at least one instance, the attacker escalated privileges to Global Administrator, using that access to create persistence by adding unauthorized credentials to other trusted security and management applications. While there is high confidence regarding the unauthorized sign-ins, the full extent of data exfiltration remains uncertain because directory reads through Microsoft Graph do not leave a comprehensive audit trail. Organizations are advised to disable affected ConnectWise applications and audit all service principal credentials for unauthorized additions.

* Threat actor used IP address 144.172.64[.]128 to access Microsoft 365 tenants.
* Unauthorized sign-ins occurred on October 15, between 06:13 and 08:34 UTC.
* The compromised credentials belonged to ConnectWise Cloud Backup (formerly SkyKick).
* Huntress confirmed unauthorized sign-ins in 162 tenants.
* In one tenant, the ConnectWise Cloud Management - MS Teams app assigned itself the Global Administrator role.
* The threat actor added unauthorized client secrets to a Huntress application and an MSP management application in one tenant.
* A second wave of attempts occurred on October 15 between 09:25 and 14:20 UTC, targeting 16 tenants in policy, national security, trade, and critical mineral sectors.
* Approximately 1,000 Entra tenants showed sign-in activity from 144.172.64[.]128, with over 300 succeeding.
* Targeted applications include ConnectWise Cloud Management for Exchange Online, MS Teams, and SharePoint Online.
* ConnectWise disabled relevant apps as of October 17 at 5:15 PM ET.

The strongest version of this narrative is a transparent, technical disclosure of a supply-chain compromise, providing specific IOCs to help the community defend itself. It correctly identifies the systemic risk of "broad permissions" inherent in backup services, where the utility of the tool becomes the primary vulnerability.
However, the delivery follows a distinct vendor-led intelligence pattern. By framing the threat through the lens of their own application being targeted—and then detailing the "strengthened safeguards" they implemented in response—the provider creates a narrative where the vendor is both the detective and the solution. This serves to convert a security crisis into a demonstration of product efficacy and vigilance.
Patterns detected: ARC-0061 Authority Game, ARC-0014 Fear Appeal
The root cause is the "Trust Paradox" of the MSP model: the more central a management tool is to an ecosystem, the more catastrophic its compromise becomes. This echoes the Kaseya and SolarWinds patterns, where the trusted path is the path of least resistance.
This incident highlights a degradation of human agency; when app-only sign-ins bypass MFA and user interaction, the traditional "human-in-the-loop" security model vanishes. The beneficiary here is the security vendor whose "fleet-wide monitoring" is validated as essential.
Bridge Questions:
1. If directory reads leave no audit trail, how can any organization truly verify a "clean" result after a service principal compromise?
2. At what point does the operational risk of broad-permission third-party apps outweigh their backup utility?
Counterstrike Scan: A coordinated campaign would use this event to trigger a mass exodus from cloud-backup services toward a specific competitor. This content does not match that pattern; it provides actionable mitigation for the existing ecosystem rather than pushing a replacement product.