SkyKick Compromise Raises Cloud Tenant Security and Backup Access Concerns for MSPs
· 1:10:04 · Watch on YouTube ↗
Summary
BHIS panelists discuss the reported SkyKick compromise, stolen application credentials and persistence risks across customer cloud tenants. They urge log reviews and warn that disabling affected apps may not remove attacker access.
Key points
- Panelists describe attackers using compromised backup application credentials to authenticate across MSP and MSSP customer tenants with extensive privileges; the initial compromise method remains unclear.
- The discussion cites Huntress reporting hundreds of customers with authentication attempts and a smaller subset with additional activity, including attempted persistence.
- According to the public timeline described by panelists, ConnectWise became aware of the incident on October 14 and disabled stolen credentials on October 17.
- Panelists say ConnectWise reported no evidence that backup archives were accessed, but stress that this does not resolve the separate risk of compromised customer tenants.
- Affected backup services remained unavailable during the discussion. ConnectWise's cited guidance instructed customers not to reconnect affected applications until formal restoration instructions were provided.
- Defenders are urged to review cloud telemetry for post-compromise activity, audit application privileges and investigate persistence rather than relying solely on disabling the affected application.
- Other discussions cover Cairn's reported AI-assisted retail targeting, exposed MCP servers, HTTP-header prompt injection research and Citizen Lab's investigation of advertisement-delivered zero-click spyware.
Article Details
- Topics
- [04:35] SkyKick and ConnectWise compromise affecting MSP backup access and customer cloud tenants
- [17:51] Incident disclosure, credential revocation and downstream response responsibilities
- [41:29] Cairn and the economics of AI-assisted attacks against retail targets
- [45:58] Proactive defense, deception and attack-surface reduction against automated attackers
- [53:46] Research into prompt injection delivered through HTTP response headers
- [55:12] Internet-exposed MCP servers and insufficient access controls
- [58:14] Advertisement-delivered zero-click spyware and mobile telemetry limitations
- [01:03:07] Reported arrest over a suspicious recording device installed at Open AI
MITRE ATT&CK
People
BronwynPanel participant discussing the downstream impact on small MSP customers and the value of actionable guidance following a compromise.EricPanel participant discussing incident response, cloud telemetry, persistence risks and the limitations of reassurance focused only on backup archive access.Eric TildsAttorney cited by a panelist as warning that many MSP contracts provide limited legal protection for incidents of this kind, with some MSPs lacking contracts altogether.HaydenPanel participant who describes investigating a customer with the affected application installed, finding no suspicious activity within available logs and warning about visibility gaps across cloud environments.John StrandBHIS panel participant discussing the reported compromise, community discovery, incident communications and recommendations for isolating application credentials between tenants.