Compromised ConnectWise Backup Credential Enables Access to 162 Microsoft 365 Tenants

Attackers abused a compromised credential for ConnectWise Cloud Backup for Microsoft 365, formerly SkyKick, to obtain Microsoft Graph access tokens and access customer tenants on October 15. Huntress confirmed unauthorized sign-ins across 162 tenants as of October 16 at 19:00 UTC, and ConnectWise acknowledged that the source IP was associated with unauthorized activity. Beazley Security cited public reports of email, SharePoint, and Teams data exfiltration, but Huntress said data theft remained unconfirmed because relevant read operations may leave no audit trail. The initial compromise method and full scope remain unknown; Beazley reported that no vendor remediation or workaround had been confirmed at the time of its advisory.

In one tenant, investigators also observed a separate ConnectWise Cloud Management application elevate itself to Global Administrator and add credentials to an MSP management application and the Huntress Security Platform application, creating additional access paths. Investigators have not established whether this earlier persistence activity and the backup application sign-ins involved the same operator. The role escalation aligns with MITRE ATT&CK’s Additional Cloud Roles technique, T1098.003. Defenders should preserve relevant logs, investigate unusual application sign-ins and bulk data access, disable affected service principals without deleting them, and remove unauthorized roles and credentials. Huntress advises withholding re-enablement until ConnectWise confirms that all credentials have been reset.