This week, attackers got hold of a credential belonging to a widely used Microsoft 365 backup service and used it to sign in to customer tenants around the world. Two MFC clients still had the affected applications connected, left over from a service set up many years ago and no longer in use. Huntress alerted us, we disabled the applications that same evening, and the logs show the attacker never used them in either tenant.
What happened
The problem started with the vendor, not with our clients. ConnectWise Cloud Backup (formerly SkyKick) backs up Microsoft 365 mailboxes, OneDrive, SharePoint and Teams. To do that, it needs broad access to every tenant it is installed in.
On 15 October, an attacker used a stolen credential for that application to sign in to customer tenants from a hosting provider address. By the evening of 16 October, Huntress had confirmed unauthorised sign-ins in 162 tenants. In at least one tenant, a second ConnectWise application gave itself Global Administrator rights and added new credentials to other applications.
The credential sat in the vendor's own systems. Nothing a customer did could have caused or prevented it. You can read Huntress's full technical write-up here, and ConnectWise's advisory here.
How it affected our clients
Two of the Microsoft 365 tenants we manage still had the ConnectWise (SkyKick) applications connected, from a backup service set up many years ago and no longer in use. Huntress's Security Operations Centre alerted us, and we acted on their advice straight away, on the evening of Friday 16 October.
That evening we:
- Disabled the ConnectWise and SkyKick applications across the tenants we manage
- Reviewed the credentials on enterprise applications for anything added since 13 October
- Checked audit logs for applications granting themselves administrator roles
- Contacted both affected clients directly
The sign-in logs show the attacker did not use the applications in either tenant, and the audit logs show no credentials or permissions were changed. Neither client was compromised.
Why this matters
Your security is only as strong as the weakest supplier connected to your systems. Backup, management and security tools all need high-level access to work, which makes them attractive targets.
Access of this kind does not involve a user, a device or a password. Multi-factor authentication never comes into play. That is why monitoring for unusual behaviour, around the clock, matters as much as the protections you put up front.
There is a lesson for us here too. Applications that are no longer used can keep their permissions for years. We are reviewing every third-party application connected to the tenants we manage and removing anything that is not actively needed.
What happens next
The ConnectWise applications stay disabled. As none of our clients use the service any more, nothing changes day to day: email, files, Teams and sign-ins all work as normal.
If you are an MFC client, there is nothing you need to do. We will be in touch if anything changes. If you are not an MFC client and use ConnectWise Cloud Backup or SkyKick, speak to your IT provider today and point them to the Huntress guidance above.
Want to know how protected you are?
Every MFC managed client is covered by Huntress Managed EDR and ITDR, watched by a human-led SOC 24 hours a day. If you would like a review of the third-party applications connected to your Microsoft 365 tenant, or want to talk about protecting your business, get in touch with the team at MFC IT Services.
