On 16 October, it came to light that threat actors are using a Microsoft 365 credential to gain access to the customer environments of ConnectWise Cloud Backup (formerly SkyKick).
Is CyberSentriq/RedApp affected?
No. The incident involves a credential belonging to ConnectWise's own application. It does not involve CyberSentriq systems, applications, or credentials, and we have no indication that any CyberSentriq credential has been exposed.
Steps we recommend
The following steps strengthen your tenant against incidents like this one, and apply to every third-party application you have approved:
- Review the permissions each third-party application holds.
- Turn on Microsoft Graph activity logs, which record what an application does with its access.
- Set up alerts for application sign-ins from unexpected addresses. On request, we can provide the application IDs and the address ranges our service signs in from.
- Enable Microsoft Entra ID Protection for workload identities, which covers third-party applications and flags suspicious sign-ins.
- Know how to disable (not delete) an application quickly if you ever need to.
If you have any questions, please reach out to your account manager.