Huntress Confirms ConnectWise SkyKick Credentials Used in M365 Breaches

Security researchers at Huntress confirmed on October 16 that threat actors are abusing vendor credentials associated with ConnectWise SkyKick to access Microsoft 365 tenants. The firm reported detecting unauthorized sign-ins in 162 tenants as of 19:00 UTC, marking a significant breach of the backup service's identity.

The attackers utilized a client assertion credential, which resides in the vendor’s own tenant, to authenticate against customer environments. Huntress stated that nothing a customer did in their environment could have produced this specific credential type, indicating the compromise originated at the vendor level.

Attack Timeline and Methodology

The malicious activity began on October 15, with the application identity signing in from IP address 144.172.64[.]128. This IP belongs to a hosting provider and differs from the Azure private IP space used for legitimate traffic. The sign-ins occurred between 06:13 and 08:34 UTC, allowing the actor to receive Microsoft Graph access tokens.

Huntress observed that the actor moved through tenants in sorted GUID order, with requests spaced a few seconds apart. This pattern suggests the use of a script working from a pre-existing target list. The firm also noted an affinity for alphabetical targeting, with many interesting victims starting with the letter "A."

Prior to the credential abuse, Huntress detected password spraying against four law firm tenants from the same IP address on October 13 and 14. The actor used scripted OAuth2 token requests with a User-Agent of curl/7.88.1. Two accounts were locked out by smart lockout features, but no successful user sign-ins were observed from this IP in Huntress telemetry.

Affected Applications and Scope

Any organization with the ConnectWise Cloud Backup app installed is potentially affected. The compromised credential works against every tenant where the app has been consented, meaning the actor is not limited to the 162 tenants Huntress has confirmed so far. The broad permissions required for backup and restore allow reading and writing of data.

Huntress identified that the threat actor abused credentials for three specific ConnectWise Cloud Management applications. These include Exchange Online, Microsoft Teams, and SharePoint Online. As of the time of the report, Huntress noted that these apps did not appear to have been disabled by ConnectWise.

ConnectWise has acknowledged the incident on its website and confirmed that the IP address is associated with unauthorized activity. Todyl also reported on this incident. Huntress continues to monitor the situation and has asked impacted organizations to share tradecraft details at their security contact email.

What should you do?

Administrators should immediately review Microsoft Entra Admin Center logs for sign-ins from IP 144.172.64[.]128. Check for the specific application IDs associated with ConnectWise Cloud Management to identify unauthorized access.

Organizations should disable the ConnectWise SkyKick applications in their tenants until the vendor provides a confirmed fix. Monitor for any unusual data access patterns, particularly in mailboxes, OneDrive, SharePoint, and directory data.

What to do and how to stay safe: ConnectWise

• Review Microsoft Entra sign-in logs for activity from IP 144.172.64[.]128 and the specific ConnectWise application IDs listed by Huntress.
• Disable the ConnectWise Cloud Management apps for Exchange Online, Teams, and SharePoint Online in your tenant immediately.
• Check for unauthorized access to mailboxes, files, and directory data, as the compromised credentials have broad read and write permissions.
• Monitor for any new sign-ins using client assertion credentials, as this indicates the vendor's identity is being used without customer action.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What IP address is associated with the unauthorized ConnectWise SkyKick sign-ins?

The unauthorized sign-ins originated from IP address 144.172.64[.]128, which is a hosting provider address.

Which Microsoft 365 applications are being abused by the threat actor?

Huntress confirmed abuse of ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint Online.

How many tenants have been confirmed as affected by Huntress?

Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16.