OTX Threat: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used to gain unauthorized access to customer M365 environments. The threat actor authenticated from IP address 144.172.64.128 on October 15, obtaining Microsoft Graph access tokens across hundreds of tenants. The attacker moved through tenants in sorted GUID order, suggesting automated targe CVEs: CVE-2025-11371 Sectors: Technology, Government