A compromised API secret for ConnectWise Cloud Backup, formerly SkyKick Backup, has left hundreds of customers exposed in an ongoing supply-chain attack. The credential belongs to a multi-tenant application, so whoever holds it can request access tokens in any tenant where the app is installed, with no action by the customer and no multi-factor prompt.
Huntress dates the credential’s use to around October 14 and saw the first wave of attacks on Friday, October 16. Microsoft Threat Intelligence observed broad successful sign-ins from a malicious IP on October 15. By October 17, Huntress had seen sign-in activity across almost 1 000 Entra tenants, more than 300 of which appeared to succeed, and confirmed unauthorized sign-ins in 162 — with more likely beyond its own telemetry. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management that day.
Disabling the app may not be enough. In tenants where Huntress saw post-compromise activity, the application’s account elevated its own privileges and added credentials to other applications, which would keep access alive after the original app was switched off.
ConnectWise says it has no view into customer tenants and cannot tell whether any individual Microsoft 365 environment was accessed, so every affected tenant needs its own review. Huntress, ConnectWise, and Todyl all advise disabling ConnectWise Cloud Backup and ConnectWise Cloud Management – MS Teams in the Entra admin center even if the logs look clean. Existing backup archives remain encrypted and preserved.
Source: CyberScoop
