---
title: Hunt: ConnectWise/SkyKick service-principal abuse in Entra (144.172.64.128, Python UAs, self-assigned roles, new app secrets) | ctxsec
url: https://ctxsec.com/items/hunt-connectwise-skykick-app-abuse
description: ""
status: "hunt idea (vendor + Huntress IOCs), last updated 2026-10-21"
published: 2026-10-17
updated: 2026-10-21
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-connectwise-skykick-app-abuse.md)

hunt idea (vendor + Huntress IOCs)

2026-10-17 · updated

2026-10-21

### Hunt: ConnectWise/SkyKick service-principal abuse in Entra (144.172.64.128, Python UAs, self-assigned roles, new app secrets)

(1) Entra sign-in logs, Service principal sign-ins tab: filter app ID 506e08f9-6e9a-4da4-942b-a099a03644ae and look for any IP outside Microsoft/Azure ranges, especially 144.172.64.128 (normal egress is Azure private IPv6). (2) Audit log: ConnectWise/SkyKick service principals adding themselves to directory roles (Global Admin, Exchange Admin, Privileged Authentication Admin), and those principals modifying other applications. (3) User-agent contrast: ConnectWise apps normally use kiota-dotnet; ConnectWise lists Python-urllib/3.12 and python-requests/2.31 as IOCs, and Huntress saw curl/7.88.1 in password spraying from the same IP Oct 13–14. (4) Any client secret or certificate added since Oct 13 to any enterprise app or app registration, especially MSP and security tools (T1098.001). A clean log doesn't rule out access. (5) Huntress's Oct 17 5:15 p.m. ET update: audit service principal sign-ins to all four ConnectWise apps (Cloud Backup 506e08f9-…, plus the Cloud Management Exchange Online, MS Teams and SharePoint Online apps) from about 01:00 UTC Oct 15 to 02:00 UTC Oct 16. Don't hunt by IP alone, because the credential added to Huntress's own app came from private Azure IPv6 space, not 144.172.64.128. Tenants without any ConnectWise app still saw failed sign-in attempts in a targeted Oct 15 wave against policy, national-security, trade and critical-minerals organizations. (6) ConnectWise's Oct 18 01:00 UTC guidance: filter service-principal sign-ins on all seven app IDs it disabled, review from Oct 13 to now and extend back to Oct 1 where logs exist, and also check mailbox forwarding, inbox/transport rules, delegated mailbox access and new federation trusts. Tokens issued before the 07:00 UTC Oct 17 shutoff may have stayed valid until they expired.

**Update Oct 21 (Microsoft Storm-0940 / ARTEX):** expand IP filters to `144.172.64.60`, `.99` and `.128`; also hunt Graph/Sign-in activity with user agents `Python-urllib/3.12`, `python-requests/2.31.0`, `python-requests/2.34.2`, `curl/7.88.1`, `azure-toolkit/1.0`. Review app credential additions and self-assigned directory roles from at least Oct 1 where logs allow. Microsoft Defender XDR and Sentinel sample queries are in the MS blog.

Sources: [ConnectWise Trust Center advisory](https://www.connectwise.com/company/trust/advisories) · [Huntress](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access) · [Microsoft Storm-0940 / ARTEX blog](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)