SkyKick, Inc.

And again, this one's got a whole bunch of people pulling stuff here.

Now, ConnectWise has suspended its cloud backup service, formerly Skykick, along with their SaaS security and even cloud management piece.

All of those are now offline after attackers abused and compromised the credential tied to application identities in the cloud backup environment.

They reached... about 160, I believe, two or three Microsoft tenants, 162 Microsoft 365 tenants with the cloud backup.

Yeah.

So what we're talking about is a product called Skykick.

And it is more or less a cloud backup solution.

Yeah, it's a cloud migration, cloud backup.

brand, yeah.

Yeah.

So this is Skykick that's owned by ConnectWise, and it looks like around the 14th pair of credentials got compromised and not The way it reads, and we'll have all the research and the sources, so you guys can all go

through it.

I'm Charles Weaver, your host.

Today's episode begins with the security incident, which by now I'm sure all of you are aware, involving ConnectWise Cloud Backup, formerly Skykick.

ConnectWise says that an unauthorized party gained access to credentials used by their service, and outside researchers reported that those credentials were used to reach some customers' Microsoft 365 environments.

Now, ConnectWise suspended cloud backup, SaaS security, and cloud management while it investigates, remediates, and validates what a safe restoration is going to look like.

One, attackers signed into hundreds of Microsoft three sixty-five tenants using ConnectWise's own app credentials.

They signed in as ConnectWise Cloud Backup, the old SkyKick app, which customers had already approved.

Hunters counted more than three hundred tenants with successful sign-ins from the attacker's address.

In one tenant, Hunters also saw a ConnectWise management app make itself a global administrator.

You need to know what good looks like before you can ever, ever hunt for bad.

And over the weekend, we've seen something come out from ConnectWise, right? Where their cloud backup, formerly known as Skykick service, had a massive interruption.

There was a bunch of vulnerabilities going on around it.

Now, back in my day, because I'm old, sonny, you know, Skykick was an application that some folks used to do data migrations to with a third-party tool from on-premise Exchange servers and Rackspace servers and all that to pull everything into the Microsoft 365 tenancy.

So when I've first seen this story come up, I'm like, what are these MSPs doing? Again, like, why are we not deprecating tools that are being used as a one-time project and being able to, you know, Leave a foothold essentially inside of a 365 tenancy with essentially administrative passwords or administrative access to all the mailboxes because it's pulling from Bob, Jan, you know, Bill, everybody's email account from the old system to the new.

I did not know.

At the time of this story was coming out and I started going in and I started, if you caught it, you know, you see me kind of like my brain rebooted a couple of times as I went through this story.

I did not know that in 2015, Skykick actually started doing 365 backups at the same time.

Applying the lesson costs an afternoon.

List every enterprise app in your tenant and disable, don't delete, the ConnectWise and Skykick ones.

Deleting removes consent.

Keep them off until ConnectWise confirms its credentials are reset.

covered yeah yeah exactly kelvin one closing question um in chat can you address that by chance

Yeah, so Lock7ai2 said, if our client has the SkyKick app in their O365, but the multi-tenant portal has already been deleted prior to the incident, is there any chance of a compromise? I'm not sure I get the entire question.

I think you deleted the app already before compromise.

If so, there should be no danger, but I would still recommend you to just audit.