ConnectWise suspends Cloud Backup after stolen app credential is used to access Microsoft 365 tenants

ConnectWise has suspended its Cloud Backup service, formerly SkyKick, after attackers used a compromised credential belonging to the service's Microsoft 365 application to sign in to customer tenants. ConnectWise said on 16 October 2026 that it had "identified unauthorized access to application identities within the ConnectWise Cloud Backup environment," The Register reported.

What happened? #

Security firm Huntress says a client credential for the ConnectWise Cloud Backup Microsoft 365 app was compromised and used to obtain Microsoft Graph tokens in customer tenants. Because the attacker signed in as the application rather than as a user, multi-factor authentication did not apply, Todyl and SpecterOps explained. The attacker inherited whatever permissions customers had already granted the backup app, which can reach mail, OneDrive and SharePoint files, Teams chats and directory data.

Microsoft Threat Intelligence described the incident as an active supply chain attack and assessed that the attacker likely abused existing permissions, including Directory.ReadWrite.All, BleepingComputer reported.

How many organizations are affected? #

Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on 16 October and saw directory role changes, mostly Exchange Administrator assignments, in about 50 tenants it monitors. It also said nearly 1,000 Entra tenants recorded sign-in activity from the attacker's IP address. The total number of affected organizations has not been disclosed.

What did the attackers do? #

In one tenant, Huntress saw the ConnectWise Cloud Management Teams app add itself to the Global Administrator role. A script then added client secrets to an MSP management app and to Huntress's own app, which could let an attacker get back in after the original credential is reset.

In the one tenant Huntress reviewed in detail, the audit log showed no mail or file access, but Huntress noted that Microsoft Graph directory reads leave no audit trail, so data access cannot be ruled out. Todyl found that in tenants without an active backup subscription a token was issued but no mailbox or file reads followed, which it said suggests reconnaissance.

ConnectWise has said it "cannot discuss threat actor attribution at this time," according to The Register. How the credential was obtained has not been disclosed.

What is the timeline? #

What has ConnectWise said about customer data? #

ConnectWise has said it has no indication that partner backup data was accessed, Coalition reported. In an 18 October update, it said existing archives "remain encrypted, isolated, and preserved, with no evidence of unauthorized access," according to The Register. Scheduled backups are not running, and ConnectWise said it had disabled seven application identities, though previously issued tokens may stay usable until they expire, BleepingComputer reported. No restoration timeline has been given.

Which Microsoft 365 apps should admins check? #

SpecterOps lists these ConnectWise application IDs. Older tenants may show them under SkyKick names.

What should Microsoft 365 admins do? #

1. Disable, do not delete, the ConnectWise Cloud Backup app and the other ConnectWise or SkyKick apps in Microsoft Entra. Keep them disabled until ConnectWise confirms all credentials have been reset. Tokens already issued may remain valid for up to 90 minutes.
2. Review client secrets and certificates on every enterprise app and app registration for any added since 13 October. Disabling the ConnectWise apps does not remove credentials the attacker added to other apps.
3. Remove any directory roles held by ConnectWise or SkyKick apps that you did not grant on purpose.
4. Search service principal sign-in logs for the app IDs above and for the IP address 144.172.64[.]128. Huntress and Coalition list the user agents Python-urllib/3.12 and python-requests/2.31 as indicators, but say they are not proof of compromise on their own.
5. Export and preserve logs now, since default retention may be short, and turn on Microsoft Graph activity logs, which are not retroactive.
6. Plan for a backup gap. Huntress says disabling the app pauses backups but does not delete existing backups held by ConnectWise.