Attackers used the stolen credential of the ConnectWise Cloud Backup app (formerly SkyKick) to get into hundreds of Microsoft 365 tenants, including in Spain. If you or your IT provider ever installed it, even if it sits unused, have Entra ID checked today: MFA and password resets are not enough.
Key facts
- Malicious activity began no later than 15 October, from a single IP: 144.172.64[.]128 (BleepingComputer).
- Huntress identified at least 162 compromised tenants in its environment; its later count rose to 173 with confirmed unauthorised sign-ins (The Hacker News).
- In around 50 tenants, the ConnectWise Cloud Management apps assigned themselves directory roles, mainly Exchange Administrator. In one tenant, the attacker established persistence in about five minutes.
- ConnectWise disabled seven application identities on 17 October at 07:00 UTC and suspended Cloud Backup. Scheduled backups are not running and restores are unavailable (The Hacker News).
- The ID of the legitimate app abused in the attacks is 506e08f9-6e9a-4da4-942b-a099a03644ae.
Am I affected if I've never heard of ConnectWise?
You might be. Many small businesses don't run their own Microsoft 365: an MSP does. If your provider ever installed Cloud Backup or SkyKick, the app is still in your tenant with the permissions it was granted, even if nobody has used it for years. In older tenants, the management apps may show up as 'SkyKick Cloud Manager'. The campaign hits organisations in several countries, Spain among them.
Why didn't MFA protect me?
Because no user ever signed in. The attacker used the app's secret and authenticated as the app through a script. That way it inherited everything your company had already granted: reading and writing mail and attachments, OneDrive and SharePoint files, and Teams chats. Microsoft Threat Intelligence calls it an active supply-chain attack and believes existing permissions such as Directory.ReadWrite.All were abused (BleepingComputer).
Three caveats matter. Shutting down the connections blocks new authentications, but doesn't undo what the attacker changed earlier. Tokens already issued stay valid until they expire. And revoking user sessions does not cut off app-based access.
What about my backups?
While the suspension lasts, your Microsoft 365 backup with this service is not working. ConnectWise says backup files remain encrypted and isolated, and that there is no evidence attackers accessed them (The Hacker News). It is still unknown how the credential was exposed or whether a product vulnerability played a part.
What to do today
- Export the Entra ID and Microsoft 365 logs before you change anything.
- In Entra ID, open Enterprise applications and look for ConnectWise or SkyKick apps, including dormant ones and the ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Keep them disabled until further notice.
- Review service principal sign-ins since 13 October. Look for IP 144.172.64.128 or any IP outside Microsoft/Azure ranges.
- Review secrets and certificates added to any application since 13 October and remove the ones you don't recognise.
- Check whether any app assigned itself a Global or Exchange administrator role.
- Look for forwarding or inbox rules nobody created.
- Set up an alternative Microsoft 365 backup while Cloud Backup is down.
- If the tenant holds personal data, assess with your DPO or adviser whether this is a GDPR breach. If confirmed, you have 72 hours to notify the Spanish DPA (AEPD).
What it means for a small business
The uncomfortable lesson is that the most powerful identity in your mailbox wasn't an employee. It was a backup tool nobody may have remembered. It had no MFA, it never showed up in password reviews, and it could read and write almost everything. That blind spot is what got exploited.
We suggest two things. First, ask your MSP for a list of the applications with permissions in your tenant and what each one is for. Anything with no owner and no use goes. Whatever stays gets the minimum permissions. Second, don't leave your backup, and its security, with a single provider and no plan B: anyone relying solely on this service today can neither back up nor restore.
This doesn't need a big project. It needs someone with admin access to spend an hour or two on the steps above today. If you don't have that person, our cybersecurity team can help you review it.
FAQ
Is changing passwords and enabling MFA enough?
No. Access was made with the application's identity, not with users. You need to review and disable the app, its secrets and any roles it assigned itself.
Were my backups stolen?
ConnectWise says they remain encrypted and isolated, with no evidence of access. The confirmed risk is in the tenant itself: mail, OneDrive, SharePoint and Teams.
Do I have to notify the AEPD?
Only if a personal data breach is confirmed, and then within 72 hours. Assess it with your DPO or adviser after reviewing the logs.
