Today’s Field Note

ConnectWise pulled the plug on its Cloud Backup service (formerly SkyKick) after unknown actors got hold of application identities and used them to breach customer Microsoft 365 tenants. Seven app identities are now disabled, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae). This is the supply-chain pattern that keeps working: compromise the trusted third party, inherit its OAuth consent, skip the login screen entirely. Meanwhile Drupal shipped fixes for two critical RCE flaws affecting all supported versions, with maintainers openly warning exploits are likely soon. No PoC yet, but “patches landed, exploits coming” is a short runway, so treat it as a clock already running.

Today’s Action

  • In Entra ID, audit service principals and OAuth grants for the seven disabled ConnectWise app identities (starting with 506e08f9-6e9a-4da4-942b-a099a03644ae) and revoke any lingering consent or tokens.
  • Pull Microsoft 365 sign-in and audit logs for activity tied to those app identities and flag any unexpected mail rules, data access, or admin changes.
  • If you run ConnectWise Cloud Backup / SkyKick, assume exposure until proven otherwise and rotate affected tenant secrets.
  • Patch all Drupal installs to the fixed releases now, before a PoC lands, and prioritize internet-facing sites.
  • Review any other vendor-owned app registrations in your tenant and strip unused or over-permissioned consent.

The trusted third party is just your attack surface with an invoice.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.