{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/connectwise-cloud-backup-formerly-skykick/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ConnectWise Cloud Backup (formerly SkyKick)","ConnectWise Cloud Management app for Microsoft Teams"],"_cs_severities":["high"],"_cs_tags":["cloud-security","supply-chain","identity-theft","m365"],"_cs_type":"advisory","_cs_vendors":["ConnectWise","Microsoft"],"content_html":"\u003cp\u003eSecurity researchers have identified an active campaign where unknown threat actors are leveraging a compromised Microsoft 365 (M365) service principal credential associated with ConnectWise Cloud Backup (formerly SkyKick) to access customer environments. The compromised application holds extensive permissions to mailboxes, OneDrive, SharePoint, Teams, and directory data. The attackers have been observed moving through impacted tenants in a scripted manner, obtaining Microsoft Graph tokens to facilitate unauthorized data access.\u003c/p\u003e\n\u003cp\u003eIn addition to direct data access, the threat actors have demonstrated the ability to escalate privileges within affected tenants by modifying application configurations and adding new client secrets to other highly privileged MSP management and security applications. This activity effectively persists the actor's presence and expands their reach across the MSP's downstream client base. ConnectWise has temporarily suspended application access while investigating the breach. Defenders should prioritize auditing Entra ID sign-in and audit logs for the specified application IDs and unauthorized activities occurring from known attacker infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to the ConnectWise Cloud Backup service principal credential via an undisclosed method.\u003c/li\u003e\n\u003cli\u003eActor authenticates to Microsoft Graph as the compromised ConnectWise Cloud Backup application using the stolen credential.\u003c/li\u003e\n\u003cli\u003eAttacker uses the app's inherited permissions to access sensitive organizational data, including Exchange mailboxes, SharePoint, and OneDrive files.\u003c/li\u003e\n\u003cli\u003eActor interacts with Entra ID to assign the application Global Administrator privileges.\u003c/li\u003e\n\u003cli\u003eActor uses the application context to identify other trusted, privileged MSP or security management applications installed in the tenant.\u003c/li\u003e\n\u003cli\u003eActor executes scripts (observed using Python-urllib/3.12 user-agent) to add new client secrets to these trusted applications.\u003c/li\u003e\n\u003cli\u003eActor leverages the new client secrets to facilitate long-term persistence and facilitate movement into other downstream customer tenants.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAt least 173 Microsoft 365 customer tenants have been confirmed as compromised. The attack allows for unauthorized access to sensitive mailboxes, SharePoint/OneDrive files, and directory data. Furthermore, the ability to inject credentials into security and MSP management tools creates a high risk of supply chain contamination, potentially allowing the attacker to pivot from a single compromised tenant into the MSP's entire client base.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDisable the ConnectWise Cloud Backup (App ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and ConnectWise Cloud Management app (App ID: 24205314-2b89-4e07-a2a4-579e898a5640) in your Entra ID environment until confirmed safe by the vendor.\u003c/li\u003e\n\u003cli\u003eAudit Entra audit logs for any unauthorized modification of application credentials or role assignments involving the specified App IDs since October 13, 2026.\u003c/li\u003e\n\u003cli\u003eBlock the IP address 144.172.64.128 at the network perimeter or within cloud conditional access policies as it has been identified as a source of malicious authentication activity.\u003c/li\u003e\n\u003cli\u003eEnable and review Microsoft Graph activity logs for abnormal data access patterns or unauthorized token requests.\u003c/li\u003e\n\u003cli\u003ePerform a credential rotation for all MSP and security-related applications that may have been accessed or modified by the ConnectWise service principal.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-17T06:39:10Z","date_published":"2026-10-17T06:39:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-compromise/","summary":"Threat actors are exploiting a compromised service principal credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 Microsoft 365 tenants and potentially escalate privileges.","title":"Unauthorized Access to Microsoft 365 Tenants via Compromised ConnectWise Credentials","url":"https://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - ConnectWise Cloud Backup (Formerly SkyKick)","version":"https://jsonfeed.org/version/1.1"}