What Happened
The Hacker News reports Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants. Attackers used the compromised credential of ConnectWise Cloud Backup, formerly SkyKick, to obtain Microsoft Graph tokens. The app holds broad access to mail, OneDrive, SharePoint, Teams, and directory data. Because the attacker signed in as the application, no user prompt or multi-factor step appeared. In one tenant, a ConnectWise Teams app added itself to the Global Administrator role and planted new secrets on two other apps. BleepingComputer reports ConnectWise disabled seven application identities on October 17.
Why This Matters for Canadian Organizations
Canadian managed service providers sell Microsoft 365 backup to small and mid-sized firms across the country. Law firms, clinics, and municipalities rely on these tools. Huntress saw password spraying against four law firm tenants before the token theft. A breach of mailbox content triggers PIPEDA breach assessment duties, and provincial health and public sector rules add more.
Revoking user sessions does not stop this access. Issued tokens stay valid for up to 90 minutes after you disable the app. Some directory reads leave no audit trail.
What to Do
Open Entra sign-in logs, select the Service principal sign-ins tab, and filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Disable the ConnectWise and SkyKick applications until ConnectWise confirms credential resets. Review secrets added since October 13. Check audit logs for apps assigning themselves directory roles. Enable Microsoft Graph activity logs. Read more in our TechTalk coverage.
