A stolen ConnectWise backup credential opens 173 Microsoft 365 tenants

According to The Hacker News on 17 October, the attacker obtained the credential of an application, formerly known as SkyKick, that managed service providers use to back up Microsoft 365 data for their clients. A tenant is an organisation's separate environment within Microsoft 365. Huntress observed Microsoft Graph access tokens being issued to the address 144.172.64.128 between 06:13 and 08:34 UTC on 15 October. The attacker worked through tenants in order of their ID numbers, a few seconds apart, which points to a script running from a ready-made target list.

Because the credential belonged to an application rather than a user, the attacker inherited every permission customers had previously granted to it. Multi-factor authentication never came into play. Microsoft described the incident as an active supply chain attack and said directory write permissions such as Directory.ReadWrite.All may have been abused. In at least one partner tenant, a second ConnectWise application added itself to the Global Administrator role. A Python script then wrote new secrets to two other trusted applications.

According to Todyl, disabling the application stops new tokens from being issued, but tokens already granted remain valid for up to 90 minutes. ConnectWise has suspended application access until further notice and says it has found no evidence that partners' backup data was compromised. How the credential was stolen has not been disclosed. SpecterOps' note of 17 October cites a Huntress count of 162 tenants; the figure rose to 173 during the day.