The CyberCall Podcast
The Voice of Cybersecurity for MSPs & MSSPs!
The CyberCall is the weekly podcast where cybersecurity meets business reality. Hosted by Andrew Morgan, Founder of Right of Boom, this is the go-to show for Managed Service Providers (MSPs), virtual CISOs (vCISOs), and IT leaders navigating the complex world of cyber risk, compliance, and AI.
Each episode features raw, practical conversations with the sharpest minds in cybersecurity—from operators in the trenches to CISOs, researchers, policymakers, and toolmakers shaping the future. If you care about protecting your clients, growing your practice, and becoming the security partner businesses trust—this podcast is your playbook.
Co hosts: Phyllis Lee, VP of Content at CIS & Gary Pica, President of TruMethods
The CyberCall Podcast
Breaking Down the SkyKick Tenant Access Incident
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Even if you've never used ConnectWise Cloud Backup, formerly SkyKick, this week's incident holds a lesson for every MSP. On October 15, a threat actor used a stolen credential belonging to that app to sign in to customer Microsoft 365 tenants. Huntress has confirmed more than 160 so far, and it believes the threat actor also abused several of ConnectWise's Cloud Management apps. ConnectWise has shut off Cloud Backup access while it investigates, so backups are paused for the MSPs and clients who rely on it.
What makes this one interesting is how the threat actor got in. They used a trusted app that already had broad access to client tenants, and all of us have apps like that in our clients' environments. In one tenant, Huntress also found a ConnectWise app that made itself a Global Administrator and then added new keys to two other apps, including Huntress's own. With Global Administrator rights, an app can reach a lot more than backups.
Today we're going to cover what we know, what we don't, and what MSPs should be doing this week, whether you were affected or not, including how to handle regulated clients.
Joining us are Andrew Brandt from Huntress, Kelvin Tegelaar from CyberDrain, John Strand from Black Hills Information Security and Antisyphon Training, and Eric Tilds for the legal perspective.