Clarissa Hana
ConnectWise has taken decisive action to suspend customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a sophisticated cyberattack that compromised application identities and infiltrated numerous Microsoft 365 tenants. The breach, which began to surface on Friday, has sent ripples of concern through the managed service provider (MSP) community, as administrators discovered unauthorized access to sensitive client data within their Microsoft 365 environments, with initial reports pointing to a potential "SkyKick/CW breach."
The gravity of the situation was confirmed later that day by Huntress, a prominent managed cybersecurity and threat detection platform. Huntress reported identifying at least 162 compromised tenants within its network, underscoring the widespread nature of the attack. Microsoft itself corroborated these findings in a recent post, acknowledging malicious activity involving ConnectWise’s Cloud Backup service and pinpointing unauthorized authentication attempts originating from a single IP address on October 15.
ConnectWise’s Cloud Backup solutions are integral to the operations of MSPs and IT teams, offering essential backup and recovery services for critical customer data, including emails and files, across cloud platforms like Microsoft 365 and Google Workspace. The service’s integration with Microsoft 365 relies on permissions granted through Microsoft Entra ID (formerly Azure Active Directory). Within a customer’s tenant, a specific application identity, known as a "service principal," acts as a digital representation of the software, enabling it to access resources based on the permissions it has been allocated. It is through the exploitation of these service principals that the attackers gained unauthorized entry.
Unraveling the Microsoft 365 Tenant Breaches
In a formal security advisory, ConnectWise disclosed the discovery of "unauthorized access to application identities within the ConnectWise Cloud Backup environment." In response, the company immediately terminated application access for its partners and clients, a swift measure aimed at containing further damage. Crucially, ConnectWise stated, "We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored." Despite this assurance, a comprehensive investigation and remediation efforts are actively underway.
The malicious activity, according to intelligence from Microsoft, Huntress, and affected administrators, appears to have commenced on or around October 15, emanating from a single, persistent IP address: 144.172.64[.]128. Anecdotal evidence from affected parties highlights the insidious nature of the attack. One user on Reddit recounted receiving an alert from Microsoft Privileged Identity Management (PIM) on October 15, notifying them that a SkyKick service principal had inexplicably assigned itself the role of Exchange Administrator, despite the service not having been utilized for years. This specific detail suggests a targeted exploitation of dormant or previously granted permissions.
Remarkably, the application identities associated with the offensive SkyKick activity, as reported by various cybersecurity entities including Huntress, Microsoft, and Todyl – a cybersecurity platform tailored for MSPs and IT professionals – align with each other. This cross-verification strengthens the attribution of the attack.
Technical Exploitation: Abusing Granted Permissions
Todyl researchers provided a detailed analysis, explaining that the attacker authenticated directly to Microsoft 365 by leveraging the backup application’s secret, thereby assuming the permissions that customers had previously granted. The infiltration was executed through automated script-driven sign-in requests. A critical aspect of this attack vector is its bypass of traditional security measures like multi-factor authentication (MFA), as these protections are typically designed to safeguard user logins, not automated application authentications.
"Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats," Todyl explained in a blog post detailing their investigation. In their analysis of nine compromised tenants, Todyl researchers observed only sign-in activity and found no evidence that the threat actor "created accounts, added permissions, changed passwords, or established persistence in any tenant through the backup app." This suggests an initial phase focused on data exfiltration and reconnaissance rather than outright system takeover.
Reconnaissance, Persistence Attempts, and a Wider Attack Campaign
However, the scope of the attacker’s actions appears to have been more extensive in other environments. Huntress reported observing on nearly 50 tenants that service principals associated with "ConnectWise’s Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigned themselves directory roles, most commonly Exchange Administrator." This indicates a pattern of privilege escalation beyond simple data access.
In one particularly alarming instance monitored by Huntress researchers, the attacker successfully established persistence within a tenant. This operation, which lasted approximately five minutes, saw the "Cloud Management – MS Teams" service principal (application ID: 24205314-2b89-4e07-a2a4-579e898a5640) elevate itself to Global Administrator status. Furthermore, the attacker proceeded to add credentials to an MSP management tool and even Huntress’s own application, a move that could have facilitated further lateral movement and deeper compromise.
Microsoft’s Threat Intelligence team echoed these findings, reporting observed persistence activity via a backdoor following successful service principal authentication. This was followed by "Microsoft Graph API reconnaissance and attempts to add additional credentials," painting a picture of a deliberate and multi-stage attack. The convergence of evidence, with all three cybersecurity firms tracking the malicious activity back to the same IP address (144.172.64[.]128), strongly suggests a coordinated and sophisticated operation. Microsoft Threat Intelligence has officially characterized the incident as an active supply-chain attack, with the assessment that the attacker likely exploited existing permissions, including the powerful Directory.ReadWrite.All scope.
Indicators of Compromise and Essential Tenant Checks
To aid in the detection and mitigation of this threat, cybersecurity firms have released key indicators. Huntress identified the legitimate Cloud Backup application ID used in the attacks as 506e08f9-6e9a-4da4-942b-a099a03644ae. Their investigation also linked the attacker’s IP address to scripted sign-in attempts on October 13 and 14, utilizing the user agent string "curl/7.88.1."
Further analysis has uncovered at least three user agent strings associated with the malicious Cloud Backup service activity: "python-urllib/3.12," "python-requests/2.31," and "python-requests/2.34.2." These technical details are crucial for administrators seeking to identify any suspicious activity within their own Microsoft 365 environments.
ConnectWise has provided specific recommendations for administrators to bolster their defenses. They advise reviewing service principal sign-ins within Entra ID, filtering by the Cloud Backup application ID, and meticulously examining any unexpected source IP addresses. Microsoft concurs with this approach, recommending a thorough review of application credential changes, OAuth grants, and related Microsoft Graph API activity.
Huntress offers a more assertive stance, advising administrators to immediately disable the implicated ConnectWise applications. They also stress the importance of scrutinizing application credentials for any unauthorized additions made since October 13 and promptly removing such entries. A critical note from Huntress is that older tenants might list the relevant Cloud Management applications under the name "SkyKick Cloud Manager," necessitating a broader search.
The vendor’s immediate shutdown of the service, while a necessary containment measure, does not retroactively remove any malicious credentials that may have already been planted within customer tenants. Huntress emphasizes that administrators must proactively review secrets and certificates across all applications for any unauthorized additions occurring since October 13, ensuring their removal.
Todyl further elaborates on the persistence of the threat, warning that disabling an application prevents the issuance of new authentication tokens but does not invalidate existing ones until their natural expiration. Similarly, revoking user sessions does not terminate access granted at the application level, highlighting the persistent nature of the compromise.
ConnectWise announced the interruption of its backup service at 05:01 UTC on October 17. As of the time of this report, no definitive timeline has been provided for the restoration of services. The company has reiterated its lack of evidence indicating a compromise of stored backups and assured that existing archives will remain accessible once services are fully reinstated.
The full extent of the victim count and the precise nature and volume of any data exfiltrated remain unclear. Furthermore, the method by which the attackers initially obtained the vendor credentials necessary to launch this supply-chain attack is still under investigation, leaving a critical question mark in the unfolding narrative of this significant cybersecurity incident. The incident serves as a stark reminder of the interconnectedness of the digital ecosystem and the profound impact a single vulnerability in a trusted vendor can have on a vast network of organizations.
