Signal//Noise #038 - Nothing Like Getting Skykick'd

Signal//Noise #038 - Nothing Like Getting Skykick'd ConnectWise SkyKick backup credential abused to sign in to 300+ Microsoft 365 tenants. What happened, who is exposed, and what MSPs must check now. EPISODE OVERVIEW An attacker used a credential belonging to ConnectWise Cloud Backup, formerly SkyKick, to sign in to Microsoft 365 tenants as the backup app itself, with no user, password, or MFA involved. In one tenant a related ConnectWise app made itself Global Administrator and planted secrets on other applications that survive the vendor's shutdown, and the containment took backups offline. Chris Loehr and Bob Miller walk through the timeline, the persistence risk, and the backup outage. As always, they compare analysis of the incident from five AI tools (Claude, ChatGPT, Perplexity, Grok, and Gemini) and show where the engines got it right and where they did not. WHAT WE COVER \- How the ConnectWise Cloud Backup (SkyKick) application credential gave app-only access to customer tenants \- Why MFA and user Conditional Access did nothing against app-only authentication \- The Global Administrator escalation and planted client secrets in one documented tenant \- Why 162, 173, 300, and 1,000 are different tenant counts that should not be added together \- Targeted sweeps against policy, national security, trade, and critical minerals organizations \- The backup outage and the recovery point gap it creates \- Two AI-recommended fixes that do not work for third-party multi-tenant apps KEY TAKEAWAYS \- Any tenant that ever consented to SkyKick or ConnectWise Cloud apps is in scope, including dormant ones \- Disabling the vendor apps does not remove secrets planted on other applications \- Check service principal sign-ins, not user sign-ins, for the published IPs and app IDs \- Workload identity Conditional Access and App Instance Property Lock do not protect you from a vendor's multi-tenant app \- Plan interim backup coverage until ConnectWise restores service and confirms credential rotation ABOUT THE SHOW Signal // Noise is a cybersecurity podcast where Chris Loehr and Bob Miller break down the latest security incidents, threats, and trends. Each episode runs the same incident through five leading AI analysis tools (Claude, ChatGPT, Perplexity, Grok, and Gemini) then compares results live on air. Subscribe for weekly analysis that helps security professionals and business leaders stay ahead of emerging threats. RESOURCES \- Original article (Huntress): https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access \- ConnectWise Trust Center advisories: https://www.connectwise.com/company/trust/advisories \- Todyl investigation: https://www.todyl.com/blog/investigation-unauthorized-access-through-the-connectwise-cloud-backup-microsoft-365-app \- BleepingComputer coverage: https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/ \- Blumira guidance: https://www.blumira.com/blog/connectwise-cloud-backup-skykick-compromise \- Supporting Files: https://app.v3.irgame.ai/c/S2NFiles