ConnectWise credential compromise exposes MSP customers to M365 attacks

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup - formerly SkyKick - has been compromised and is being actively used to gain unauthorised access to customer M365 environments, security vendor Huntress has confirmed.

Huntress said it has high confidence that the threat actor abused ConnectWise Cloud Management applications for Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center. The vendor flagged the incident directly to affected partners and has urged immediate action.

In one Huntress partner tenant, a ConnectWise Cloud Management application for Microsoft Teams gave itself Global Administrator privileges and then added new credentials to two other applications in the same tenant - one of them a single-tenant Huntress application unique to that partner.

That escalation path means disabling the ConnectWise applications alone is not sufficient to contain the breach.

"Disabling M365 apps, including the abused ConnectWise apps, will not remove credentials that were already added," Huntress warned. "You must review the credentials on all of your M365 applications."

Microsoft sign-in logs show the second application connection originating from a private IPv6 address inside Microsoft's own cloud network. Huntress noted that legitimate ConnectWise traffic and unrelated customer traffic also appear from the same address range, and said the IP alone does not identify who operated the system.

Impacted organisations should immediately disable two specific application IDs in their Microsoft 365 tenant: ConnectWise Cloud Backup (formerly SkyKick, Application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and ConnectWise Cloud Management - MS Teams (Application ID: 24205314-2b89-4e07-a2a4-579e898a5640).

Huntress also recommended considering the temporary disabling of other ConnectWise Cloud Management application IDs.

Partners were advised to disable - not delete - the application IDs, as disabling does not affect backups ConnectWise has already stored. Huntress said affected applications should not be re-enabled until ConnectWise confirms all credentials have been reset.

ConnectWise has suspended Cloud Backup in response to the observed indicators of unauthorised activity.

Because SaaS Security and Cloud Management are integrated with Cloud Backup, the company said it also suspended those services as a precautionary measure while investigation and remediation continue.

ConnectWise said its incident response, engineering and operations teams are working around the clock with third-party specialists.