This is a supply-chain hit that MSPs and anyone running Microsoft 365 should look at today. ConnectWise shut down access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers got into application identities and used them to reach customer Microsoft 365 tenants.
What we know
- ConnectWise says it found “unauthorized access to application identities within the ConnectWise Cloud Backup environment” and cut off application access for partners and clients. It says it has no indicators so far that backup data itself was compromised.
- Huntress identified at least 162 compromised tenants in its environment. Microsoft confirmed malicious activity tied to the service, starting at least October 15.
- One admin reported a Privileged Identity Management alert of a SkyKick service principal assigning itself Exchange Administrator, in a tenant that hadn’t used the app in years.
What I’d do
- In Entra ID, review enterprise apps and service principals for SkyKick/ConnectWise Cloud Backup. Revoke or disable what you don’t need.
- Check role assignments and audit logs since October 15 for privilege changes by app identities.
- Check the IOCs published by Huntress, Microsoft and the vendor advisory against your sign-in logs.
- Clean up old third-party app consents in general. Forgotten apps with big permissions are exactly what got abused here.
My take
The scary part is the “hadn’t used the app in years” detail. Every app you ever granted tenant permissions to is still a door until you remove it.
