Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants: The Hacker News Research

Executive Summary

According to security intelligence published by The Hacker News, Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.

ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) to secure their clients' Microsoft 365 or Google Workspace data. To accomplish its tasks, the application is granted broad access to mailboxes, OneDrive, SharePoint, Teams, and directory data in every tenant on which it's installed.

Huntress said it has observed confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. The incident impacts every organization that has the app installed, and the credential works against every tenant the app is consented in.

Technical Context

Security advisories and threat research published by The Hacker News highlight the importance of auditing distributed microservices, validating automated integrations, and eliminating unintended public service exposures.

Key Considerations for Infrastructure Teams

• Service Discovery & Exposure Audits: Continuously scan internet-facing assets and microservices to detect unintended public exposure.
• Authentication & Protocol Hardening: Enforce strict mutual TLS (mTLS) or robust token-based authentication on all management interfaces.
• Vulnerability Lifecycle Management: Maintain automated dependency tracking and rapid patching protocols for third-party protocols and libraries.

Recommended Mitigation Steps

1. Review internal systems and endpoints matching the advisory scope disclosed by The Hacker News.
2. Restrict external network access and implement least-privilege network controls for background services.
3. Conduct deep endpoint audits using automated testing tooling to verify secure handshake and header configurations.

Editorial Notice: This bulletin is an independent editorial summary based on reporting and disclosures published by The Hacker News. CertificateGuardian curates industry intelligence to assist infrastructure teams in securing web endpoints.