r/sysadmin • u/dhuskl • 18h ago

Skykick Breach Immediate action required

EDIT: More Skykick enterprise apps being exploited https://www.reddit.com/r/sysadmin/s/M6iilUpoJl

Skykick, the SAAS backup and migration tool now owned by Connectwise (May be called Connectwise Cloud backup) has been breached and active exfil of tenant data is ongoing, disable the Entra enterprise application immediately and check your logs for the IP here. Check for skykick access from previous MSPs.

https://www.reddit.com/r/msp/s/ieagdCmOBb

The IP in your logs doesn't necessarily mean exfil has started as they seem to be mass scanning tenants presumably for high value targets but exfil has been confirmed already in some tenants.

IP: 144.172.64.128

APP ID: 506e08f9-6e9a-4da4-942b-a099a03644ae

Other skykick app IDs are below (there are more than listed below so do a manual check), no reports of access on these but threat hunt. Check the APP ID and not the Object ID on the enterprise app.

2399d300-6fca-4e6a-a686-399fefe75b83 fc2bedd5-450f-4d3c-a2e5-96d2465574d6 ccd0fb86-b4b4-48f1-a3c4-28bd1baeae6e 7441fd5e-1d54-4465-8e18-8f5208c48256 0de14c77-b9b0-4137-9360-34878a929827 2568dd75-4f97-46c4-9235-ff6bcb68557c

This one is also skykick but not mentioned in the title. "0365 Backup Self Service - Customer Access" 59c003ad-130e-4c4c-9796-f0c13cbd7952

Report of suspicious activity with the app making changes to permissions 2 days ago, see comments on the Reddit link above

Keep an eye on activity for activity related to any CW app to be safe.

Legal is involved as they say no backup data was accessed - because they accessed your live data directly. Disingenuous. https://www.connectwise.com/company/trust/advisories

174 Upvotes

98% Upvoted

22 comments sorted by

View all comments

•

u/fencepost_ajm 9h ago

IMPORTANT - AT LEAST ONE ADDITIONAL APP HAS BEEN COMPROMISED as of Friday evening

See this thread about the second application, Friday evening vs the Friday morning of the Skykick/Backup one.

https://www.reddit.com/r/msp/comments/1x7wbwf/connectwise_skykick_update/

https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app

•

u/dhuskl 9h ago

Thanks I will update the original post

•

u/KavyaJune 5h ago

Yes, it's important to audit credential additions and role assignments for existing Entra applications.