ConnectWise has cut off customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after hackers reached application identities inside the environment and compromised Microsoft 365 tenants. Administrators began reporting unauthorized access to client data on Friday, pointing to a possible SkyKick or ConnectWise breach. Microsoft later confirmed malicious activity tied to the backup service, saying it detected unauthorized authentication attempts from one IP address on October 15. ConnectWise said it recently found unauthorized access to application identities within the Cloud Backup environment and shut down application access for partners and clients.
ConnectWise said it has no indicators so far that partner backup data was compromised and that the existing cloud backup archive is unaffected by the service interruption and will be accessible once services are restored. The company has opened an investigation and is carrying out remediation. Its cloud backup products help managed service providers and IT teams back up and restore customer data such as email and files across Microsoft 365 and Google Workspace. For Microsoft 365 backups, the service depends on permissions granted through Microsoft Entra ID, with a service principal representing the software in a customer tenant.
Huntress, a managed cybersecurity and threat detection platform, confirmed the concerns and said it identified at least 162 compromised tenants in its environment. Todyl, a cybersecurity platform aimed mainly at MSPs and IT professionals, said the attacker authenticated directly to Microsoft 365 as the backup application using its secret and inherited the permissions customers had already granted. Todyl said the sign-in requests came from an automated script, so protections such as multi-factor authentication were ineffective because no user login was involved. Because the application already held broad permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats, according to Todyl.
In nine tenants it analyzed, Todyl found only sign-in activity and no evidence that the threat actor created accounts, added permissions, changed passwords, or established persistence through the backup app. Huntress, however, observed on nearly 50 tenants it monitors that service principals for ConnectWise Cloud Management apps covering Exchange Online, Microsoft Teams and Microsoft Graph assigned themselves directory roles, mostly Exchange Administrator. In one tenant, Huntress saw the attacker establish persistence in about five minutes. During that activity, Cloud Management - MS Teams granted itself a Global Administrator role and added credentials to an MSP management tool and to Huntress's own application.
Microsoft also observed persistence activity through a backdoor after successful service principal authentication, followed by Microsoft Graph API reconnaissance and attempts to add additional credentials. Microsoft Threat Intelligence described the incident as an active supply-chain attack and assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All. A Reddit user said a Microsoft Privileged Identity Management notification on October 15 flagged a SkyKick service principal assigning itself the Exchange Administrator role, despite the app not being used for years.
All three cybersecurity companies traced the activity to the same IP address, 144.172.64[.]128. Huntress identified the legitimate Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae used in the attacks and linked the attacker IP to scripted sign-in attempts on October 13 and 14 with the user agent curl/7.88.1. Evidence so far links at least three user agents to the malicious Cloud Backup activity: python-urllib/3.12, python-requests/2.31 and python-requests/2.34.2. The affected service is used by MSPs and IT teams, a channel that supports many US businesses' Microsoft 365 environments.
More cybersecurity news from TechManNews.
