ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
Summary
An attacker exploited a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain access to customer Microsoft 365 tenants. The stolen application credential granted the attacker the same permissions as the ConnectWise application, enabling unauthorized access. The article provides guidance on how to check your Microsoft 365 tenant for signs of compromise.
IFF Assessment
This article details a breach where an attacker exploited a compromised credential to access customer environments, representing a loss for defenders.
Defender Context
This incident highlights the critical importance of securing third-party application credentials, especially those with elevated permissions in cloud environments. Defenders should regularly audit the permissions granted to integrated applications and implement robust credential management practices to prevent similar supply chain attacks.