[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

ConnectWise Cloud Backup (SkyKick) M365 app abuse: contain and verify

Contain and check Microsoft 365 tenants exposed through the stolen ConnectWise Cloud Backup app credential. Based on ConnectWise's Trust Center advisory (Oct 16–17) and Huntress's Oct 16 report.

For: Security lead, M365 / Entra admin, MSP operator, SOC / threat hunter

1. Find the apps2. Disable, don't delete3. Check sign-ins4. Check roles and app changes5. Sweep every app's credentials6. Assume data exposure until proven otherwise
  1. Step 1 of 6

    Find the apps

    The stolen credential works in every tenant where the app is consented, and Huntress saw a second ConnectWise app abused.

    • In Entra > Enterprise applications search 'ConnectWise' and 'SkyKick'
    • Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint b2b55f5b-7758-4719-8d8f-88ae172e6bdb
    • Older tenants may show 'SkyKick Cloud Manager'
  2. Step 2 of 6

    Disable, don't delete

    Deleting removes consent; disabling pauses backups but keeps existing archives, and ConnectWise has already shut off Cloud Backup app access.

    • Set 'Enabled for users to sign-in' to No on Cloud Backup and any ConnectWise app you can't verify
    • Note the backup gap for your recovery-point records
    • Don't re-enable until ConnectWise confirms all credentials are reset
  3. Step 3 of 6

    Check sign-ins

    App-only sign-ins show only on the Service principal sign-ins tab.

    • Filter by app ID 506e08f9-… and look for IPs outside Microsoft/Azure ranges
    • Search for 144.172.64.128
    • Remember a clean result doesn't rule out access
  4. Step 4 of 6

    Check roles and app changes

    In one tenant the MS Teams app made itself Global Administrator and added secrets to two other apps within about five minutes.

    • Audit log: ConnectWise/SkyKick principals added to directory roles, then remove roles you didn't intend
    • Audit log: those principals modifying other applications; note Python-urllib/3.12 or python-requests/2.31 user agents versus the usual kiota-dotnet
    • Review Conditional Access policies that exclude these apps
  5. Step 5 of 6

    Sweep every app's credentials

    Credentials added to other apps survive disabling the ConnectWise apps and work from anywhere without MFA.

    • List client secrets and certificates added since Oct 13 on all enterprise apps and app registrations, especially MSP and security tools
    • Remove and rotate anything you didn't create
    • MSPs: repeat across every customer tenant your management apps are consented in
  6. Step 6 of 6

    Assume data exposure until proven otherwise

    Graph directory reads leave no audit trail and the backup app holds broad mail, file and Teams access.

    • Treat mailbox, OneDrive/SharePoint and directory data in affected tenants as potentially read
    • Brief legal/privacy on notification triggers
    • Report suspicious activity to [email protected] and track the Trust Center for updates

Original content by ctxsec. Printable checklist: use your browser's print view.