ConnectWise Cloud Backup (formerly SkyKick) recently experienced a security incident that is having ongoing impacts, with the company’s initial advisory published on October 16th and the most recent update posted on October 30th. This malicious activity stems from the fact that the ConnectWise application grants itself a Global Administrator role with extensive permissions. Compromising a single credential from this application enabled attackers to gain unauthorized access to others, including Huntress applications. In response to the incident, ConnectWise has temporarily disabled the affected cloud apps while investigation and remediation are carried out.
One Secret Exposing Every Tenant
The entry point for this malicious activity was a single compromised publisher credential for multi-tenant apps. This one credential could be used to achieve access to Cloud Backup alongside Microsoft Teams, Exchange, and SharePoint management tools. Entra was issuing tokens in every place that the ConnectWise app was already consented, including Graph tokens that leave no trail for auditing.
Huntress’s research into the incident flagged suspicious sign-in activity across about 1,000 different Entra tenants, with more than 300 successful sign-ins carried out. These include successful sign-in attempts in tenants with no active subscription.
Identities With No One Behind Them
This attack is significant in its use of app-only sign-in activity to evade typical barriers to compromise and attain high privilege within the targeted system. Signing in as an application does not require deceiving a user, compromising a device, or working around multi-factor authentication prompts. Revoking user sessions does not stop the attack, and certain application activity like Graph reads do not surface in audit logs, leaving no trace of malicious behavior.
Why Switching It Off Isn't Enough
Although ConnectWise has suspended the affected cloud applications, this is not sufficient on its own to mitigate the damage associated with this type of compromise. Disabling the Microsoft 365 apps that you use is also not enough to remove credentials that have been previously added.
Secrets planted in other apps outlive the disabled applications and persist beyond remediation. Old relationships with managed service providers (MSPs) may still carry leftover SkyKick consents. The full extent of what data attackers could access with this method is still under investigation, and the harm may go further than we know at this time.
Asking the Right Questions
In the face of an incident like this, it is important to understand where the problem lies in order to remediate it and mitigate the chances of similar attacks in the future. ConnectWise’s updated advisory states that the company’s investigation process is currently in its third stage of four, with backups, restores, and customer access and monitoring already restored. The messaging from ConnectWise repeatedly assures customers that backup data has not been accessed in this attack, but fails to address many other pressing questions.
The findings from Huntress, on the other hand, indicate the extent to which ConnectWise’s advisory may be underplaying the risk. “What else could the attackers access? Compromised application credentials can let attackers into customer tenants and give them access to data through Microsoft Graph,” says John Strand, Owner, Black Hills Information Security. “Customers need a clear explanation of that exposure.”
The Search Customers Must Carry Out
In order to find where applications may have been accessed in this attack and remediate the damage, customers using the affected ConnectWise applications must conduct a search based on guidance from security experts. Indicators of compromise in this incident include service principal sign-ins after October 13 from IP address 144.172.64.128. Secrets and certificates should be reviewed first on all enterprise applications, MSPs, and security tools.
Customers should also look for activity like ConnectWise/SkyKick applications self-assigning directory roles and unauthorized inbox rules and mail forwarding. All applications that have been disabled during investigation and remediation of this incident should be left disabled until credential rotation is confirmed and ConnectWise explicitly communicates that they are safe to re-enable.
App Consent as Standing Privilege
This incident highlights a blind spot in many security strategies, where applications are granted outsized privileges and not treated as sources of risk. Once these applications are consented, they can achieve a wide range of malicious ends if compromised. Closing this gap requires governing third-party approvals as if they were administrator accounts, and performing regular consent reviews and cleanup to cut off standing privilege that was not deliberately granted or is no longer needed. Every vendor secret should be treated as a risk in an increasingly interconnected, sprawling supply chain.
