Security Advisory

ConnectWise Suspends Cloud Backup After Attackers Abuse Its Microsoft 365 App Access

October 19, 2026 · Cyber One Solutions Security Team

ConnectWise has suspended Cloud Backup, formerly SkyKick, after attackers used the app's own credential to sign in to customer Microsoft 365 tenants. Backups and restores are offline with no restoration date yet. Here is what is known, what to check if you use it, and what every Microsoft 365 business should review.

ConnectWise has suspended its Cloud Backup service for Microsoft 365, formerly SkyKick Cloud Backup, after attackers used the service's own application credential to sign in to customer Microsoft 365 tenants. Scheduled backups, archive access, and restores are unavailable while ConnectWise investigates, and as of its October 19 status update it had no confirmed restoration time. If your business backs up Microsoft 365 with ConnectWise Cloud Backup or a SkyKick-branded app, review your tenant now and plan for the restore gap. If it does not, the incident is still a good reason to check which third-party apps hold standing access to your tenant.

What Happened

Huntress, a security firm investigating the incident, reports that on October 15, 2026, between 06:13 and 08:34 UTC, the Cloud Backup app's credential "was used to obtain Microsoft Graph tokens in customer tenants" from the IP address 144.172.64[.]128. Microsoft Threat Intelligence separately reported "broad successful service principal authentication originating from" that address and called it "an active supply chain attack." Huntress also reports that earlier on October 15, in roughly 50 tenants, ConnectWise Cloud Management service principals assigned themselves directory roles, mostly Exchange Administrator, and that in one tenant an app added itself to the Global Administrator role. Huntress says it has not confirmed whether those role changes were the vendor's own automation.

ConnectWise's status page records its response. On October 16 it reported that it was investigating attempts at unauthorized access. Early on October 17 it said it had "identified unauthorized access to application identities" and was shutting off Cloud Backup application access, and at 07:00 UTC that day it disabled the seven ConnectWise application identities listed on its Trust Center. Later on October 17 it revoked certificates, stated that "The shared credentials previously used for Cloud Backup are no longer valid," and engaged a third-party incident response firm. On October 18 it added two more addresses to watch for: 144.172.64[.]99 and 144.172.64[.]60.

Why Multi-Factor Authentication Did Not Stop It

These sign-ins came from an application, not a person. Backup and management tools are usually granted tenant-wide permissions through administrator consent, and they authenticate as a service principal with a certificate or secret rather than a user's password. Multi-factor authentication protects user sign-ins, so it never came into play. Microsoft says the attacker likely abused permissions previously granted to the affected apps, including Directory.ReadWrite.All. That is the weakness this incident exposes: one vendor credential trusted across many customer tenants can be as powerful as an administrator account in each of them.

What Is Offline, and What Is Not Known

ConnectWise's latest update says "Cloud Backup, SaaS Security, and Cloud Management remain suspended" and that "Scheduled backups, archive access, and restores remain unavailable." Its status page also flags Cloud Migration and the Cloud Services Portal. The other ConnectWise products listed there, including its RMM, PSA, ScreenConnect, and Automate platforms, show as operational.

Several things are not established. ConnectWise says it has "no evidence that these encrypted backup archives have been accessed," but also that it cannot determine whether a particular customer's Microsoft 365 environment experienced unauthorized activity. How the credential was obtained has not been disclosed, and no attacker has been publicly identified. Counts of affected tenants are still moving: Huntress confirmed unauthorized sign-ins in 162 tenants as of October 16, and on October 17 reported almost 1,000 Microsoft Entra tenants with sign-in activity from the attacker's address, more than 300 of them successful. ConnectWise has not published a count.

If You Use ConnectWise Cloud Backup or a SkyKick App

ConnectWise's technical investigation and remediation workflow is the authoritative, step-by-step guide; work through all of it for your own tenant and every tenant you manage. In order of priority:

Contain first. Confirm that every affected application ConnectWise lists is disabled in each tenant, and keep them disabled until ConnectWise issues formal restoration instructions. Huntress advises disabling the applications rather than deleting them, so their configuration and evidence remain. Do not hold off on containment while logs export.
Preserve the logs promptly. Microsoft Entra keeps sign-in and audit logs for seven days on Microsoft Entra ID Free and 30 days with P1 or P2, so activity from October 13 to 15 is about to age out of Free tenants. Export every sign-in category (interactive user, non-interactive user, service principal, and managed identity), the Entra audit logs, Microsoft Purview audit records, and any SIEM data.
Check sign-ins for every affected app, not just Cloud Backup. ConnectWise lists seven affected application identities, including Cloud Management and older SkyKick-named integrations; the Cloud Backup app is Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. In Microsoft Entra, open Monitoring, then Sign-in logs, select the Service principal sign-ins tab, and filter by each listed Application ID in turn.
Review every result in context. Treat the published IP addresses as indicators to search for, not as the only sign of trouble, and do not assume a sign-in is legitimate because it came from a Microsoft or Azure address.
Look for persistence, not just the original access. ConnectWise notes that disabling the connections "does not reverse changes previously made inside a tenant" and that previously issued access tokens may remain usable until they expire. Huntress recommends reviewing credentials added to any application since October 13 and recent directory role assignments, especially Exchange Administrator and Global Administrator. An attacker with this level of access can also leave other ways back in, so also review application owners and consent grants, federation and domain trust settings, Conditional Access and named-location changes, changes to users and their authentication methods, and Exchange changes such as mailbox forwarding, inbox and mail flow rules, and delegated mailbox permissions (Full Access, Send As, and delegation), and use ConnectWise's workflow for the complete list. For the applications themselves, Microsoft's compromised and malicious application investigation playbook covers reviewing their credentials, permissions, and consent.
Report suspicious activity to ConnectWise at [email protected], and make sure whoever administers each tenant has seen the guidance.
Plan for the gap. Until restores return, these backups cannot be used for recovery, so confirm what other options you have for mail, OneDrive, and SharePoint if something is deleted or encrypted in the meantime.

What Every Microsoft 365 Business Should Check

You do not need to use ConnectWise to learn from this. Any backup, security, or management tool connected to Microsoft 365 holds similar standing access.

Review the enterprise applications in Microsoft Entra and the permissions each has been granted. Microsoft's guide to reviewing permissions granted to enterprise applications explains how to see and revoke them.
Remove apps you no longer use, and question any that hold broad permissions, such as Directory.ReadWrite.All or full mailbox access, without a clear need.
Limit who can grant consent. Microsoft's guidance on configuring how users consent to applications explains how to restrict user consent to verified publishers or turn it off.
Watch app sign-ins, not just user sign-ins. Service principal sign-ins are logged separately from user sign-ins and are easy to overlook.
Keep an independent recovery path and test restores, so one vendor's outage does not leave you without a way back.

Where Cyber One Solutions Stands

Cyber One Solutions does not use ConnectWise products, including Cloud Backup, in the services we deliver. If you are not sure which third-party apps have access to your Microsoft 365 tenant, or whether your backups would hold up through an incident like this, our IT and security assessments can review your tenant's app permissions, and our backup and disaster recovery service can help you build a recovery path you control.