ConnectWise has suspended customer access to its cloud backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
Reports of the malicious activity first surfaced on Friday, with administrators observing unauthorized access to customer data in Microsoft 365 tenants due to a possible “SkyKick/CW breach.”
Later the same day, managed cybersecurity and threat detection platform Huntress confirmed the concerns, saying it had identified at least 162 vulnerable tenants in its area.
In a post today, Microsoft also confirmed malicious activity related to ConnectWise’s cloud backup service and said it detected unauthorized authentication attempts from an IP address on October 15.
ConnectWise’s cloud backup solutions provide backup and recovery services that help managed service providers (MSPs) and IT teams protect and restore customer data such as email and files in cloud environments such as Microsoft 365 and Google Workspace.
For Microsoft 365 backups, the service relies on permissions granted via the Microsoft Entra ID. An application identity, called a “service principal,” represents the software in a customer’s tenant and allows it to access resources according to granted permissions.
Microsoft 365 tenant violations
In one Safety noticeConnectWise said it “recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment” and has blocked application access for its partners and customers.
“We have no indication to date that backup data from cloud backup partners has been compromised. The existing cloud backup archive is not affected by this service interruption and will be accessible once services are restored.” ConnectWise says.
However, the company has launched an investigation and is seeking remedial action.
Based on reports from Microsoft, Huntress and administrators, the malicious activity began at least on October 15 from a single IP address: 144.172.64(.)128.
One user on Reddit said that on October 15, they received a notification from the Microsoft Privileged Identity Management (PIM) service that a SkyKick service principal had assigned itself the role of Exchange Administrator despite not having used the app in years.
Still, some of the reported IDs for the offensive SkyKick match those of Huntress, Microsoft and Todyl – a cybersecurity platform primarily aimed at MSPs and IT professionals.
According to Todyl researchers, the attacker used his secret to authenticate himself directly to Microsoft 365 as a backup application, thereby gaining the permissions that customers had already granted him.
The login requests were handled by an automated script, and because they did not require a user login, protections like multi-factor authentication (MFA) were ineffective.
“Because the application already had extensive, previously granted permissions in each tenant, these logins gave the attacker the technical ability to read and write emails and attachments, OneDrive and SharePoint files, and Teams chats.” Todyl said.
In the nine tenant breaches analyzed, Todyl researchers only identified login activity and found no evidence that the threat actor “created accounts, added permissions, changed passwords, or established persistence in a tenant via the backup app.”
Reconnaissance and persistence experiments
However, Huntress saw Across nearly 50 tenants, service principals for “ConnectWise’s cloud management applications (Exchange Online, Microsoft Teams, and Microsoft Graph) are monitored to have assigned themselves directory roles, primarily Exchange Administrator.”
For one tenant, Huntress researchers also observed that the attacker built up persistence and the process took about five minutes.
During the activity Cloud Management – MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) granted himself the role of global administrator and added credentials to an MSP management tool and Huntress’ own application.
Microsoft too observed persistence activity via a backdoor after successful service principal authentication, followed by “Microsoft Graph API reconnaissance and attempts to add additional credentials.”
It should be noted that all three cybersecurity companies have traced the malicious entity to the same company 144.172.64(.)128 IP address.
Microsoft Threat Intelligence classified the incident as an active supply chain attack and estimated that the attacker likely abused existing permissions, including Directory.ReadWrite.All.
Indicators and tenant controls
Huntress has identified the legitimate cloud backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae used in the attacks. The investigation also linked the attacker’s IP address to scripted login attempts on October 13 and 14 through the user agent Curls/7.88.1.
Based on current intelligence, there are at least three user agents associated with the cloud backup service’s malicious activity: python-urllib/3.12, Python requests/2.31, python-requests/2.34.2.
ConnectWise recommends administrators review service principal logins in Entra, filter by Cloud Backup application ID, and investigate unexpected source addresses.
Microsoft also recommends reviewing changes to application credentials, OAuth grants, and related graph activity.
Huntress recommends administrators disable affected ConnectWise applications, review application credentials for unauthorized additions, and review other cloud management integrations.
The company notes that older tenants may list cloud management apps under “SkyKick Cloud Manager.”
The company provides administrators with an expanded list of application IDs to search for:
- ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae)
- ConnectWise Cloud Management (2399d300-6fca-4e6a-a686-399fefe75b83)
- ConnectWise Cloud Management – MS Teams (24205314-2b89-4e07-a2a4-579e898a5640)
- ConnectWise Cloud Management – Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519)
- ConnectWise Cloud Management – MS Graph (0de14c77-b9b0-4137-9360-34878a929827)
- ConnectWise Cloud Management – Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e)
- ConnectWise Cloud Management – SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)
Closing the provider does not remove the credentials that have already been created in customer tenants. Huntress says administrators should check secrets and certificates in all applications since October 13 for unauthorized additions and remove those entries.
Todyl warns that disabling an application prevents new tokens from being issued, but existing tokens remain valid until they expire, and revoking user sessions does not terminate application-based access.
ConnectWise announced the interruption of the backup service at 05:01 UTC on October 17, but did not provide a timeline for restoring the connection.
The company reported no evidence that stored backups were compromised and said existing archives would be accessible after reservices were restored.
At the time of publication, the number of victims and the extent of the data theft remained unclear, as did the method the attacker used to obtain the provider’s credentials.
