Full Report
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
Analysis Summary
# Incident Report: ConnectWise (SkyKick) Vendor Credential Abuse in Microsoft 365 Tenants
## Executive Summary
A Microsoft 365 API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used to access customer M365 environments. In at least one Huntress partner tenant, a second ConnectWise application granted itself Global Administrator and added credentials to other applications, including a Huntress single-tenant app. Huntress advised impacted organizations to disable the affected ConnectWise applications and review credentials on all M365 apps.
## Incident Details
- **Discovery Date:** Not explicitly stated in the available text. The article was published October 16, 2026.
- **Incident Date:** Not stated in the available text.
- **Affected Organization:** Not named. At least one Huntress partner tenant was affected, and the article refers to "customers' M365 environments" more broadly.
- **Sector:** Not disclosed. The affected customers are MSPs and their clients.
- **Geography:** Not disclosed.
## Timeline of Events
### Initial Access
- **Date/Time:** Not specified in the available text.
- **Vector:** Compromised Microsoft 365 credential (API secret) associated with ConnectWise Cloud Backup (formerly SkyKick, Application ID `506e08f9-6e9a-4da4-942b-a099a03644ae`). How the secret was obtained is not described in the available text.
- **Details:** Huntress confirmed the credential was being used to gain unauthorized access to customer M365 environments.
### Lateral Movement
- In one Huntress partner tenant, the application **ConnectWise Cloud Management - MS Teams** (Application ID `24205314-2b89-4e07-a2a4-579e898a5640`) granted itself Global Administrator.
- The application then added new credentials to two other applications in that tenant, one of which was a single-tenant Huntress application unique to that partner.
- Microsoft sign-in logs show the second application's connection originating from a private IPv6 ULA address (`fde4[:]8dba[:]2600[:]37ce[:]6d26[:]200[:]a76[:]*`). Huntress notes that legitimate ConnectWise traffic and unrelated customer traffic also appear to come from this range, so the address alone does not identify the operator. Attribution is still under investigation.
### Data Exfiltration/Impact
- Unauthorized access to customer M365 tenants, including Global Administrator privileges in at least one tenant.
- Persistence through added application credentials.
- Data theft is not described in the available text.
### Detection & Response
- **Discovery:** Huntress identified the abuse. The article does not describe the specific detection method in the available text.
- **Response actions:**
- Impacted organizations were advised to disable (not delete) the ConnectWise Cloud Backup and ConnectWise Cloud Management - MS Teams applications.
- Other ConnectWise Cloud Management application IDs were recommended for temporary disablement.
- Organizations were told to review credentials on all M365 applications, since disabling apps does not remove credentials already added.
- Affected ConnectWise applications should not be re-enabled until ConnectWise confirms all credentials have been reset.
## Attack Methodology
- **Initial Access:** Abuse of a compromised vendor API secret (ConnectWise Cloud Backup).
- **Persistence:** Addition of new credentials to existing applications, including a Huntress single-tenant app. Disabling the apps does not remove these credentials.
- **Privilege Escalation:** The ConnectWise Cloud Management - MS Teams app granted itself Global Administrator.
- **Defense Evasion:** Not described in the available text. The use of legitimate vendor applications likely blended the activity with normal traffic.
- **Credential Access:** The initial API secret was compromised. Additional credential methods are not described in the available text.
- **Discovery:** Not described in the available text.
- **Lateral Movement:** Movement across applications within the tenant, using the second ConnectWise app to add credentials to other apps.
- **Collection:** Not described in the available text.
- **Exfiltration:** Not described in the available text.
- **Impact:** Unauthorized access to M365 tenants and a potential loss of tenant control through Global Administrator access.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Scope and type of data accessed are not described in the available text. ConnectWise backups already stored are not affected by disabling the apps, according to Huntress.
- **Operational:** Disabling the ConnectWise apps may disrupt backup and management services for MSPs and their clients until ConnectWise confirms credential resets.
- **Reputational:** Affects ConnectWise's reputation and the trust MSPs place in vendor-integrated applications.
## Indicators of Compromise
- **Network indicators (defanged):**
- Private IPv6 ULA: `fde4[:]8dba[:]2600[:]37ce[:]6d26[:]200[:]a76[:]*` (note: shared with legitimate traffic; not a standalone identifier)
- **Application indicators:**
- ConnectWise Cloud Backup (SkyKick), Application ID `506e08f9-6e9a-4da4-942b-a099a03644ae`
- ConnectWise Cloud Management - MS Teams, Application ID `24205314-2b89-4e07-a2a4-579e898a5640`
- Other ConnectWise Cloud Management application IDs (not listed in the available text)
- **Behavioral indicators:**
- An application granting itself Global Administrator
- An application adding new credentials to other applications in a tenant
- Sign-in logs showing application connections from the ULA range above
## Response Actions
- **Containment:**
- Disable (do not delete) the ConnectWise Cloud Backup and ConnectWise Cloud Management - MS Teams applications.
- Temporarily disable other ConnectWise Cloud Management application IDs.
- **Eradication:**
- Review and remove unauthorized credentials on all M365 applications. Disabling apps alone does not remove them.
- Review role assignments, including Global Administrator grants.
- **Recovery:**
- Do not re-enable affected ConnectWise applications until ConnectWise confirms all credentials have been reset.
- Confirm backup retention and restore options with ConnectWise.
## Lessons Learned
- Vendor application credentials are a high-value target. A single compromised secret enabled access across customer tenants.
- Vendor apps with broad permissions can be used to escalate privileges and add persistence, so their permissions need regular review.
- Disabling an application does not revoke credentials it has already added to other apps. Full credential review is required.
- Private or internal IP addresses in sign-in logs may be shared by legitimate traffic and should not be used alone for attribution.
## Recommendations
- Audit all enterprise applications and app registrations in M365 for unexpected credentials, owners, and permissions, especially Global Administrator role grants.
- Monitor for applications that modify other applications' credentials or assign directory roles to themselves.
- Restrict application consent and require admin approval for high-privilege permissions.
- Rotate secrets for third-party and vendor integrations on a regular schedule, and maintain an inventory of them.
- Alert on sign-ins by service principals and on changes to role assignments.
- Establish a vendor incident contact process so you can act quickly when a vendor reports compromise.
- Verify with your vendors how their credentials are stored, rotated, and scoped before relying on them.
*Note: The source article was truncated. Details on discovery timing, the initial compromise method, and any data accessed may appear in sections not included in the text provided.*