A Backup App’s Stolen Key Opened 173 Microsoft 365 Tenants: A Playbook for Owners, IT Leads and MSPs
Attackers used a stolen credential belonging to ConnectWise Cloud Backup’s Microsoft 365 app to sign in to at least 173 customer tenants. A role-by-role playbook, and how layered defenses limit the damage when a trusted app turns hostile.
Here Is How Layered Defenses Help When a Trusted Third-Party App Becomes the Way In
Third-party apps that back up Microsoft 365 need sweeping permissions to do their job: every mailbox, every OneDrive, every SharePoint site, every Teams chat. This week that power was turned against the customers. Security firms say an unknown attacker got hold of a credential belonging to the ConnectWise Cloud Backup application (formerly SkyKick) and used it to obtain access tokens inside customer tenants.
This Layer 7 Pick draws on The Hacker News’ report on the active campaign, which compiles findings from Huntress, Todyl, Microsoft and ConnectWise. It is a developing story.
The situation in brief
- Huntress says it confirmed unauthorized sign-ins in 173 partner and customer tenants. The credential works in every tenant where the app has been granted consent.
- Huntress says Microsoft Graph tokens were obtained from IP address 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC, moving through tenants a few seconds apart in a pattern that suggests a scripted target list.
- Microsoft says it is tracking an active supply chain attack on the app’s OAuth identity, with follow-on Graph reconnaissance and attempts to add extra credentials to the app’s service principal in target tenants as a backdoor.
- In at least one tenant, Huntress saw a separate ConnectWise Teams management app add itself to the Global Administrator role and then add new secrets to two other trusted apps, an MSP management tool and Huntress’s own security app.
- ConnectWise has shut off Cloud Backup application access until further notice and says it has found no evidence that partner backup data was compromised.
One detail from Todyl matters most for responders: revoking user sessions does not end this kind of access. Disabling the app in a tenant stops new tokens, but tokens already issued can stay valid for up to 90 minutes.
The playbook, by role
If you own or run the business
- Ask your IT provider or internal admin one direct question today: is ConnectWise Cloud Backup, SkyKick, or any other third-party backup app connected to our Microsoft 365?
- Ask for a written answer on what was checked and when, not just “we’re fine.”
- Make sure you still have a recovery path for email and files while the backup app is offline, even if it is a temporary one.
If you manage the Microsoft 365 tenant
- In the Entra admin center, open Sign-in logs, switch to the Service principal sign-ins tab (the default user tab will not show it), and filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Look for activity from IP addresses outside expected Microsoft ranges, and from 144.172.64[.]128 in particular.
- Disable the application until ConnectWise confirms all credentials have been reset.
- Turn on Microsoft Graph activity logs. Huntress notes some Graph directory reads leave no audit trail otherwise.
- Audit every app and service principal for new credentials or secrets added since October 13, and check Entra audit logs for ConnectWise or SkyKick apps adding themselves to a directory role.
If you are an MSP
- Run the checks above across every client tenant, not just the ones you think use the product. Consent granted for an old trial or past project can linger.
- Pay special attention to your own management and security tools. Huntress’s finding shows an attacker adding secrets to the very apps MSPs use to reach many customers at once.
- Tell clients what you found, including “nothing,” with timestamps. Silence during a supply chain incident erodes trust faster than bad news.
Where the layers come in
No single setting would have stopped a legitimate app’s own credential from working. Layers decide how far it gets. Review third-party app consents regularly and remove permissions that apps no longer need; Directory.ReadWrite.All-level access should be rare and justified. Alert on new credentials being added to service principals and on any app joining an admin role. Keep audit and Graph activity logging on and retained long enough to investigate. And keep at least one copy of critical data that a single cloud app cannot reach or delete. Tools such as Microsoft Entra workload identity protections, Defender for Cloud Apps or a third-party SaaS security platform can help with the monitoring, but they are examples, not the answer by themselves. The answer is not trusting any one integration with the keys to everything.
What this means for your company
Most small businesses have never looked at which outside apps hold permissions in their Microsoft 365 tenant, and many would be surprised by the list. Every one of those apps is a door that largely sidesteps your users’ passwords and MFA, because it signs in as itself. Make an inventory, cut what you don’t use, and ask whoever manages your tenant to show you the logging and alerts that would catch an app behaving badly.
Need help auditing the third-party apps connected to your Microsoft 365 tenant and checking for signs of this campaign? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
