Stolen Backup Vendor Credential Used to Break Into 173 Microsoft 365 Tenants

Researchers at Huntress have warned of an active campaign in which unknown attackers are abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly SkyKick. The service is built for managed service providers (MSPs) to back up their clients' Microsoft 365 or Google Workspace data. To do that job, the app is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed.

Huntress has confirmed unauthorised sign-ins in 173 partner and customer tenants. According to researcher Jonathan Semon, the credential was used to obtain Microsoft Graph tokens from one IP address on October 15, with the actor moving through tenants in sorted order a few seconds apart, which suggests a script working from a target list. With those tokens, an attacker can read the mailboxes, files and directory data the backup service can. The incident affects every organisation that has the app installed, because the credential works against every tenant where the app has been consented.

The same IP address was also seen password spraying four law firm tenants on October 13 and 14, though Huntress found no successful user sign-ins. In at least one partner tenant, a separate ConnectWise app gave itself Global Administrator privileges and added credentials to other trusted applications, which extends the risk beyond the vendor account.