1-minute read
What a defender needs to know
Sophos X-Ops observed an automated run of ConnectWise Cloud Backup app-only Microsoft Graph token requests on October 15, from 07:11 to 08:47 UTC. The requests included Microsoft 365 tenants without active backup subscriptions. If your organization once used ConnectWise Cloud Backup or SkyKick, inspect its old application consent even if the service is no longer in use.
In Microsoft Entra, open Monitoring & health → Sign-in logs → Service principal sign-ins and filter for Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Review October 15–17 events, especially source 144[.]172[.]64[.]128 and user agents Python-urllib/3.12 and python-requests/2.31. ConnectWise also lists 144[.]172[.]64[.]99 and 144[.]172[.]64[.]60 from downstream reports. An indicator match calls for investigation alongside application identity and timing.
Review Entra audit changes since October 13 for new credentials, app registrations, consents and role assignments. Remove consent for disabled applications as Sophos recommends, remediate any unexpected secondary access, and leave affected connections disabled until ConnectWise provides service-specific reconnection instructions. Graph activity logging requires Entra P1/P2, diagnostic collection and an authorized Azure destination. Where it was collecting during the incident, correlate Graph requests with sign-ins; otherwise use available sign-in and audit history and document the gap. Verify the old consent is gone where removal applies and that unauthorized grants are revoked. ConnectWise’s vendor-side credential reset does not replace each tenant’s own review. Scheduled backups and restores were still interrupted in the captured vendor update, so arrange backup coverage during restoration.