Security researchers at Huntress say a compromised API secret belonging to ConnectWise Cloud Backup, formerly SkyKick, was used to gain unauthorized access to Microsoft 365 environments.
Huntress reported that the application authenticated from an unfamiliar hosting-provider address and received Microsoft Graph access tokens. As of 7 p.m. UTC on Oct. 16, the firm had confirmed unauthorized sign-ins in 162 tenants.
ConnectWise acknowledged unauthorized access to application identities associated with Cloud Backup. The company disabled seven application identities at 7 a.m. UTC on Oct. 17, revoked certificates used by affected connections and suspended Cloud Backup. SaaS Security and Cloud Management were also taken offline as a precaution. ConnectWise had not announced a restoration time as of its Oct. 18 updates.
What the attackers could reach
Cloud Backup needs broad Microsoft 365 permissions to copy and restore customer data. Huntress said those permissions can include mailboxes, OneDrive and SharePoint files, Teams data and directory information. An attacker holding valid app tokens could inherit that access without signing in as a user or encountering a multifactor authentication prompt.
That does not establish that data was stolen. Huntress said it did not see mail or file access in the tenant it examined most closely, although some Microsoft Graph reads leave no audit trail. The firm also observed a ConnectWise Teams application assign itself Global Administrator in one tenant and add credentials to two other applications, creating possible access paths that would survive the original credential being disabled.
Containment does not end the cleanup
ConnectWise said its encrypted backup archives remain isolated and that it has no evidence those archives were accessed. The company cautioned that this finding is separate from possible activity inside live Microsoft 365 environments.
ConnectWise advised partners to preserve and review sign-in and audit records, inspect application credentials and role assignments, and check for unauthorized mailbox rules or delegated access. Previously issued tokens may remain usable until they expire or are invalidated, and credentials planted on other applications require separate removal.
The investigation remains active. ConnectWise said it has not confirmed downstream customer compromise, while Huntress's reporting shows why affected organizations still need to review their own tenants rather than treating the service suspension as proof that every access path is closed.
