Credential Misuse Exposes 173 Microsoft 365 Tenants in ConnectWise, SkyKick Ecosystem

Key points

• Unidentified attackers abused credentials to sign in and reach environments tied to ConnectWise Cloud Backup, Microsoft 365, and SkyKick.
• 173 tenants experienced unauthorized access and tenant compromise.
• No CVE was assigned, so patching alone is not the primary fix.
• Severity is medium; identity controls, logging, and vendor coordination are key.

An incident involving unidentified actors has resulted in unauthorized entry to cloud environments, with 173 tenants affected. The activity centers on credential misuse rather than exploitation of a known software flaw. ConnectWise Cloud Backup, Microsoft 365, and SkyKick are named in the available facts, and no CVE identifier has been associated with the event.

According to the facts, the attackers authenticated with abused credentials and reached environments, leading to tenant compromise. That pattern points to identity-layer weaknesses rather than a missing patch. For school districts and government agencies, a compromised M365 tenant can expose email, files, Teams data, and identity configurations, while backup and SaaS integration platforms may hold broad access to connected systems.

The multi-tenant scope is significant. When a service provider or integration layer is involved, one set of credentials can potentially affect many downstream organizations. The 173 affected tenants illustrate how quickly credential-based access can spread across an ecosystem. Because no CVE is linked, vulnerability scanning and patching will not fully address the root cause; strong authentication, session revocation, and permission review are more relevant.

Responders should determine which accounts were used, what data or settings were accessed, and whether persistence mechanisms were added. Watch for unusual sign-ins, new OAuth applications, mailbox forwarding rules, and administrative changes. Coordination with ConnectWise, Microsoft, and SkyKick is important to confirm scope and containment. The severity is medium, but the tenant impact warrants prompt verification and monitoring.

What to do now

1. Reset passwords and revoke active sessions for any accounts tied to ConnectWise Cloud Backup, Microsoft 365, and SkyKick; enforce phishing-resistant MFA.
2. Review sign-in and audit logs for all 173 tenants, prioritizing unfamiliar IPs, impossible travel, service accounts, and privileged roles.
3. Audit OAuth applications, API permissions, and service principals; remove unused or over-permissioned access.
4. Apply least privilege to backup and integration accounts, and separate administrative identities from daily-use accounts.
5. Notify affected tenants and coordinate with ConnectWise, Microsoft, and SkyKick for scope confirmation and containment guidance.
6. Enable alerts for credential misuse, anomalous authentication, and mass data access or configuration changes.
7. Run a password hygiene and phishing awareness push, and validate incident response contacts for tenant compromise.

Original source

The Hacker News