Attackers are abusing a stolen credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a backup service that managed service providers (MSPs) use to protect their clients’ Microsoft 365 data. Security firm Huntress says it has confirmed unauthorized sign-ins in 173 partner and customer tenants. Because the app is granted broad access (mailboxes, OneDrive, SharePoint, Teams and directory data) in every tenant where it is installed, whoever holds its credential inherits that access wherever the app has been consented.
Huntress researcher Jonathan Semon said the credential was used to obtain Microsoft Graph tokens in customer tenants from the IP address 144.172.64[.]128 on October 15 between 06:13 and 08:34 UTC, moving through tenants in sorted order a few seconds apart, which suggests a script working from a target list. The same IP also password-sprayed four law-firm tenants on October 13 and 14; Huntress detected no successful user sign-ins from that. In at least one partner tenant, Huntress saw a separate ConnectWise app (the ConnectWise Cloud Management app for Microsoft Teams) add itself to the Global Administrator role and then add new client secrets to two other applications, including an MSP management app, which could extend access beyond that single tenant.
ConnectWise says it identified unauthorized access to application identities in its Cloud Backup environment and has shut off Cloud Backup application access as a protective measure. That interrupts backups for customers until further notice. The company says it has no indicators so far that partner backup data was compromised, and that existing backup archives are not affected and will be accessible once service is restored. Its investigation is ongoing.
How to check if you’re affected
Affected products are Microsoft 365 tenants where the ConnectWise Cloud Backup (formerly SkyKick) application is installed or consented, including tenants of MSP clients. ConnectWise’s own steps for looking for signs of misuse:
- In the Microsoft Entra admin center, open Monitoring, then Sign-in logs, and select the Service principal sign-ins tab. The default User sign-ins tab does not show this activity.
- Filter by application ID
506e08f9-6e9a-4da4-942b-a099a03644ae. - Review the IP address column for sign-ins from outside expected Microsoft/Azure ranges. ConnectWise says the app’s normal egress is Azure private IPv6. The suspicious address it identified is 144.172.64[.]128.
ConnectWise notes that these indicators warrant investigation but do not by themselves confirm compromise. The Hacker News reports further recommendations: disable the application until ConnectWise confirms all credentials have been reset, enable Microsoft Graph activity logs, audit for any new credentials added to applications since October 13, 2026, and check Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role. Todyl, which saw the same activity, says revoking user sessions does not end this access; disabling the app in a tenant stops new tokens being issued there, though tokens already issued remain valid for up to 90 minutes.
Sources
- ConnectWise Trust Center advisory: Cloud Backup (formerly SkyKick) Service Interruption
- Huntress: ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
- Todyl: Investigation of unauthorized access through the ConnectWise Cloud Backup Microsoft 365 app
- The Hacker News: Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants