ConnectWise suspends Cloud Backup after its Microsoft 365 app was abused
Using a credential for ConnectWise’s Cloud Backup app (formerly SkyKick), an attacker obtained Microsoft Graph tokens for customers’ Microsoft 365 tenants, Huntress and Todyl say. Todyl says the app’s consent covers reading and writing mail, files and Teams chats, and it couldn’t rule out exfiltration. Huntress’s Oct 17 count found more than 300 tenants with successful sign-ins from the attacker’s address, out of almost 1,000 with any sign-in activity from it. ConnectWise suspended Cloud Backup on Oct 17 and took SaaS Security and Cloud Management offline while it completes its review.
- Versions
- Not applicable: cloud service.
- Vendors
- ConnectWise, Microsoft
- Log retention
- 7 days on Entra ID Free, 30 days on P1 and P2
- Published
- Editor
- Austin Simas
What to do
6 steps
- 1 Disable sign-in for the Cloud Backup app, ID 506e08f9-6e9a-4da4-942b-a099a03644ae, in every tenant without deleting it, since deleting removes its consent, Huntress says.
- 5 Filter service principal sign-ins by the app’s ID back to Oct 1, flagging 144.172.64[.]128, 144.172.64[.]99, 144.172.64[.]60 and other non-Microsoft addresses, as ConnectWise and Todyl advise.
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | Attacker IP listed by ConnectWise, Huntress and Todyl | |
| IP address | Suspicious IP ConnectWise added to its list on Oct 18 | |
| IP address | Suspicious IP ConnectWise added to its list on Oct 18 | |
| App ID | ConnectWise Cloud Backup app, formerly SkyKick Backup | |
| User agent | User agent in the attacker’s sign-ins, per ConnectWise | |
| User agent | User agent in the attacker’s sign-ins, per ConnectWise |
- IP addressAttacker IP listed by ConnectWise, Huntress and Todyl
- Network
- IP addressSuspicious IP ConnectWise added to its list on Oct 18
- IP addressSuspicious IP ConnectWise added to its list on Oct 18
- App IDConnectWise Cloud Backup app, formerly SkyKick Backup
- User agentUser agent in the attacker’s sign-ins, per ConnectWise
- User agentUser agent in the attacker’s sign-ins, per ConnectWise
Timeline
- Oct 15The attacker uses the Cloud Backup app’s credential to get Microsoft Graph tokens for customer tenants, Huntress and Todyl say.
- Oct 16ConnectWise reports unauthorized access attempts on Cloud Backup and lists the attacker’s IP address.
- Oct 17ConnectWise confirms unauthorized access to Cloud Backup’s application identities and suspends the service by revoking certificates.
- Oct 17ConnectWise disables seven application identities and takes SaaS Security and Cloud Management offline.
- Oct 18ConnectWise adds two IP addresses to its indicators.
Sources
- ConnectWisePrimary source status.connectwise.com
- HuntressPrimary source huntress.com
- TodylPrimary source todyl.com
- Microsoft LearnPrimary source learn.microsoft.com