The SkyKick app credential is in hostile hands. Disable it in every tenant.

Huntress and Microsoft say a ConnectWise Cloud Backup OAuth secret minted Graph tokens across customer tenants. ConnectWise shut the app off overnight. Disabling it does not remove secrets already added.

RWP Ventures · 2026-10-17 · event 2026-10-15 · 16 min read · priority 9.3

Do not collapse four facts.

1. This is not a user password and not a CVE. The credential type Huntress and Todyl both record is a client assertion. It lives in ConnectWise’s tenant. Nothing a customer configured, and no MFA prompt, produced it. Conditional Access written for users does not apply. Revoking user sessions does not end it.
2. Huntress’s 162 is a telemetry floor, not the estate. As of 19:00 UTC on 16 October, Huntress had confirmed unauthorized sign-ins in 162 tenants. The Hacker News, citing Huntress on 17 October, reported 173. Todyl independently saw the same app identity from the same class of infrastructure. Microsoft TI did not publish a count. The credential works in every tenant where the app is still consented and enabled. Tenants that stopped paying for SkyKick years ago and never removed the enterprise application are in scope.
3. ConnectWise shutting the app off is containment, not the hunt. Overnight 17 October (status IDENTIFIED, 05:11 UTC), ConnectWise said it had identified unauthorized access to application identities and was shutting off Cloud Backup application access until further notice. It also said it has no indicators to date that partner backup archives were compromised. That is a statement about ConnectWise-held backup stores. It is not a statement about what Graph tokens did inside customer tenants.
4. Disabling 506e08f9 does not remove secrets already added to other apps. Huntress documented one partner tenant where ConnectWise Cloud Management - MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) added itself to Global Administrator at 03:44 UTC on 15 October, then a Python-urllib/3.12 client added client secrets expiring in 2028 to an MSP management application and to Huntress’s own Security Platform app. Huntress has not tied that persistence window to 144.172.64[.]128 with a source IP. Treat it as a separate hunt, not as proof that every tenant got a Global Admin.

The operator sentence: inventory Application ID 506e08f9 in every tenant you manage tonight, set it to disabled, then review credentials on every other enterprise application — especially MSP and security tools — for anything added since 13 October.

What happened

ConnectWise Cloud Backup is an MSP product. To back up mail, OneDrive, SharePoint, and Teams it holds application permissions in every tenant an administrator consented. One publisher credential, many tenants. That is the design.

Huntress’s timeline, from Microsoft’s own logs:

Todyl’s distinction from legitimate backup is useful and independently reached: real Cloud Backup egress is Azure private IPv6 (fd00:: / ULA). The malicious sign-ins were a single commercial VPS IPv4, a Python user-agent, one token per tenant, and in Todyl’s set included tenants with no active backup subscription. ConnectWise later confirmed the IP is associated with unauthorized activity.

ConnectWise’s first public note (16 October, 17:47 UTC) said it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” listed the IP and two user-agents, and said there was no indication partner backup data had been accessed. It did not name the Application ID. Overnight 17 October the status page moved to IDENTIFIED and ConnectWise shut off Cloud Backup application access. Backup jobs stop. Existing archives, ConnectWise says, remain and will be reachable when service returns.

Microsoft Threat Intelligence, 17 October, independently described the same object: a compromised trusted OAuth app, customer-granted permissions including Directory.ReadWrite.All, broad successful service-principal authentication from 144.172.64[.]128 on 15 October, Graph reconnaissance, and attempts to add additional credentials on the related service principal to keep direct access. Defender alert names Microsoft published: suspicious sign-in, Graph API activity from a Microsoft threat-intelligence IP, verified threat-actor IP. User-agents Microsoft added beyond ConnectWise’s list: python-requests/2.34.2.

MSP-community posts (r/msp, relayed by Blumira) described bulk mail / Teams / SharePoint pulls. ConnectWise has not confirmed downstream tenant data theft. Huntress has not confirmed mail or file access in the one audit log it reviewed in detail. Todyl could not attribute mailbox/file reads in subscribed tenants to the actor versus the backup job. Directory reads through Graph often leave no audit trail. Treat “no visible MailItemsAccessed” as a visibility limit, not a clean bill.

Why it matters

A backup app is consented to do what a ransomware operator wants at the identity layer: tenant-wide read, and in this product’s grant, write and restore, of mail and files, without a user, a device, or MFA. The blast radius is the MSP pattern. One publisher secret, every consented customer. Huntress’s sentence: the backup service needs broad access to do its job, and an attacker using its credentials inherits that access.

The second reason is persistence that survives the vendor kill-switch. Adding a client secret to an already-trusted application (ATT&CK T1098.001) gives the holder the same Graph rights as that app, from anywhere, until an administrator deletes the secret. Huntress saw that done to an MSP management app — which is often consented into downstream customer tenants — and to a security-platform app. ConnectWise turning Cloud Backup off does not delete those secrets. Disabling 506e08f9 does not delete them either.

The third reason is where defenders look. Interactive sign-in logs will not show this. The tab is Service principal sign-ins. Conditional Access exclusions for the backup app, if any exist, are how a VPS in AS14956 (RouterHosting; Entra geolocation Cheyenne, WY; Todyl enrichment Sydney) was allowed to look like a backup job.

This is not confirmed OT process impact. An industrial, water, or hospital tenant whose MSP installed SkyKick is still an IT compromise of Microsoft 365 at an industrial or clinical organization. Do not write a process event. Do not merge it with [yesterday’s BeyondTrust Remote Support / ARMORY CASTLE zero-day](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/) or with [September’s ScreenConnect CVE-2026-84869](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/). Same vendor family as ScreenConnect. Different product, different control plane, no CVE on this ticket.

Who / what is affected

Technical context

RWP is not reproducing the OAuth client-credentials flow. Defenders need the object and the residue.

ConnectWise Cloud Backup is a multi-tenant app published from owner tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7 (ConnectWise S-K LLC / skykick.com). Customers grant application permissions. The attacker presented the publisher credential to Entra, Entra issued an app-only Graph token, and the token inherited whatever that tenant had already consented — Huntress and Todyl: mail and attachments including EWS, OneDrive and SharePoint, Teams chats, directory data, restore. Microsoft TI assessed Directory.ReadWrite.All among the abused grants. Todyl recorded CAE token = true, Conditional Access = notApplied, clientAssertion with empty key_id and thumbprint, session IDs beginning 009ae85a-.

Hunt without treating the token request as an exploit.

ATT&CK mapping for the ticket — public reporting, not a playbook:

Threat / exploitation status

Confidence on the Application ID, the 15 October service-principal sign-ins from 144.172.64[.]128, Microsoft TI’s supply-chain classification, and ConnectWise shutting the app off: high. Confidence that Huntress’s 162/173 is the global victim count: low — it is a telemetry floor. Confidence that every token-issued tenant had mail or files copied: low as confirmed theft, moderate as potential exposure given the grant and the logging gap. Confidence that the 03:44 Global Admin tenant is the same operator as the VPS sweep: low. Confidence on actor identity: none.

What defenders should do

1. Find the app by ID, not by name, in every tenant you manage — including inherited, acquired, and “we cancelled SkyKick in 2024” tenants. Entra → Enterprise applications → filter All applications → 506e08f9-6e9a-4da4-942b-a099a03644ae. Confirm publisher ConnectWise S-K LLC. Repeat for the Cloud Management IDs in the table above. CIPP bulk-disable is acceptable if you already use it; the control is the same.
2. Disable, do not delete. Properties → Enabled for users to sign-in = No. Deleting drops consent and forces a new admin-consent cycle later. Disabling stops new tokens. Tokens already issued remain valid up to ~90 minutes. Blumira/Todyl: removing admin-consented permissions is a harder stop; export the permission list first — it is evidence. A perimeter firewall block of 144.172.64[.]128 does not stop Graph calls that originate at Microsoft.
3. Leave it disabled until ConnectWise confirms the publisher credential has been rotated. Containment of the Cloud Backup service is not the same sentence. Huntress and Todyl both say do not re-enable on a status-page all-clear that does not mention rotation.
4. Hunt credentials on every other enterprise application and app registration, especially MSP, backup, RMM, and security tools, for secrets or certificates added since 13 October that you did not create. Huntress: disabling ConnectWise apps does not remove those. Include the Huntress Security Platform application if you use Huntress. Remove unexpected secrets. If a ConnectWise/SkyKick app holds Global Administrator or Privileged Authentication Administrator, remove roles you did not grant after the app is disabled.
5. Read the right logs. Service principal sign-ins for 506e08f9, IP 144.172.64[.]128, Python user-agents, any non-Azure IP. Directory audit: role adds and application updates by ConnectWise/SkyKick identities; User-Agent Python-urllib/3.12 vs kiota-dotnet. Unified audit: MailItemsAccessed, SharePoint FileDownloaded / FileAccessed, Teams, with ClientAppId = the app. Entra ID Free keeps sign-ins seven days — export now. Enable Microsoft Graph activity logs (P1/P2, not retroactive) so the next app-only read has a source IP.
6. Tell customers the backup job will pause. Mail, Teams, and user sign-in keep working. ConnectWise says existing archives are intact. Decide whether a recovery-point gap matters before anyone re-enables.
7. Keep the other clocks. CVE-2026-76519 (Cisco SEG), CVE-2026-0322 (PAN-OS), and CVE-2026-105133 / 105134 (AhsayCBS) are due today, 17 October. CVE-2026-21589 (Atlassian) is due 18 October. CVE-2026-102764 (BeyondTrust Remote Support) landed on KEV yesterday, due 19 October, forensicTriage: Yes — that is a catalog increment on [yesterday’s Daily Top](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/), not this story. Do not steal the Entra owner for a Jira ticket. Do not skip the BeyondTrust rebuild because this article is about SkyKick.

RWP assessment

Score 9.3.

Highest-leverage development since yesterday’s BeyondTrust / ARMORY CASTLE write-up is a live, Microsoft-confirmed OAuth supply-chain against an MSP backup app, with Huntress/Todyl telemetry, a vendor kill-switch overnight, and persistence residue that the kill-switch does not touch. Evidence quality is high on the Application ID, the 15 October service-principal authentications, and ConnectWise shutting Cloud Backup off. Evidence quality is intentionally split on victim census (162/173 is a floor), on confirmed data theft versus logging gap, and on whether the Global Admin tenant is the same operator as the VPS sweep.

It outranks the BeyondTrust CVE-2026-102764 KEV add because that CVE was already [Daily Top 16 October](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/). Yesterday’s catalog row (2026.10.16 / 1748, due 19 October, forensic triage Yes) plus CISA’s dedicated 16 October alert are a material increment — rebuild guidance did not change. It outranks Fortinet CVE-2025-61624 (same KEV batch; FG-IR-26-122; CWE-22; authenticated admin CLI path traversal; CVSS 3.1 6.5 / vendor temporal 5.4; FortiOS / FortiPAM / FortiProxy / FortiSwitchManager; due 19 October). It outranks AOMEI Backupper / UNC7017 (GTIG/Mandiant 16 October disclosure of May–July five-to-ten-minute update-server tampering) because those events are months old. It outranks due-today Cisco 76519, PAN-OS 0322, and Ahsay 105134 because those stories are already on the site.

What we are not saying: that every SkyKick customer had mail stolen; that ConnectWise backup archives are confirmed clean beyond the vendor’s statement; that ScreenConnect is in this incident; that this is a CVE; that the actor is named; that this is OT process impact; that ransomware is Known.

What we are watching

• ConnectWise confirmation that the publisher credential is rotated, not merely that Cloud Backup is “contained.”
• A Huntress or Microsoft census above 173, and whether tenants with no active subscription were read.
• How many tenants besides Huntress’s one show T1098.001 on MSP or security-platform apps.
• Whether the 01:58 kiota-dotnet role assignments were vendor automation or the actor.
• Graph activity-log collections that can split actor reads from backup jobs.
• Attribution. None on the public record this morning.
• Parallel clocks: Cisco 76519, PAN-OS 0322, Ahsay 105133/105134 due today; Atlassian 21589 due 18 October; BeyondTrust 102764 and Fortinet 61624 due 19 October.
• Catalog freeze is now 2026.10.16 / 1748. Yesterday morning’s freeze was 2026.10.15 / 1746.

Sources

• Huntress — ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
• Todyl — Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App, 16 October 2026
• ConnectWise — Trust Center advisories
• ConnectWise — Cloud Backup status incident
• Microsoft Threat Intelligence — OAuth app supply-chain tracking, 17 October 2026
• The Hacker News — Compromised ConnectWise Credential, 173 tenants, 17 October 2026
• Huntress Support — 2026 October SkyKick
• Blumira — ConnectWise Cloud Backup (SkyKick) compromise
• CISA KEV JSON catalog 2026.10.16
• CISA — Urges Patching Critical Vulnerability in BeyondTrust Remote Support, 16 October 2026
• CISA — Adds Two Known Exploited Vulnerabilities, 16 October 2026
• Fortinet — FG-IR-26-122
• Mandiant / GTIG — ARMORY CASTLE Exploits BeyondTrust
• [RWP — BeyondTrust CVE-2026-102764, 16 October 2026](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/)
• [RWP — ScreenConnect CVE-2026-84869, 14 September 2026](/posts/2026-09-14-screenconnect-cve-2026-84869-kev/)
• [RWP — Cisco SEG CVE-2026-76519, 15 October 2026](/posts/2026-10-15-cisco-seg-cve-2026-76519-amp/)
• [RWP — AhsayCBS CVE-2026-105134, 11 October 2026](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/)