ConnectWise’s Credential
ConnectWise says it revoked affected Cloud Backup, formerly SkyKick, connection certificates across all users after unauthorised application-identity access. Previously shared credentials are invalid. Its monitored environments show no subsequent successful threat activity, not a downstream-tenant clearance.
Backups and restores remain unavailable, without a restoration time. New or changed data may fall outside existing recovery points. Archives remain encrypted and isolated, with no evidence of access; tenant investigations remain necessary.
Its advisory was first published on 16 October at 17:47 UTC; the latest update is 17 October, 17:00 UTC.
App-only access
Huntress and Todyl confirmed 15 October app-only Microsoft 365 sign-ins with vendor-held credentials and inherited permissions. User MFA does not protect app-only access.
Huntress confirmed 162 tenants with unauthorised sign-ins by 19:00 UTC, 16 October, in its visibility only.
Huntress’s 17 October update identifies abused Teams, Exchange and SharePoint Cloud Management apps. In one tenant, Teams obtained Global Administrator and planted secrets on two apps.
Todyl found no persistence through the backup app in its reviewed tenants. Nine without active subscriptions had no subsequent mail/file-read records; activity in active-backup tenants could not be attributed because logging could not separate legitimate and malicious use.
Who owns the next decision?
Entra Service principal sign-ins: Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; source 144.172.64.128. User logins miss app activity; indicators alone do not prove compromise.
Both teams advise disabling, not deleting, affected service principals and preserving permissions/logs. Todyl says issued tokens can last 90 minutes.
Huntress: review roles and credentials added since 13 October. Disabling one app cannot remove planted secrets.
No exfiltration is confirmed; logging remains incomplete. Archive integrity does not clear tenant exposure. Credential acquisition remains unexplained.
BlackTree proposes a short decision record for the handover: the decision, its named owner, the evidence supporting it and the unanswered question that could change it. Keep an unfinished decision visible to the next person, rather than closing it by assumption.
