An attacker has used a credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service formerly known as SkyKick, to sign in to customers’ Microsoft 365 tenants. ConnectWise has shut off the service’s application access while it investigates. Security firm Huntress says it has confirmed unauthorised sign-ins in 162 tenants among those it monitors. That is not a total count. Administrators are being urged to disable the app now.
What ConnectWise says
In an advisory on its Trust Center, first published on 16 October at 1:47 p.m. EDT (17:47 UTC, 18:47 UK time), ConnectWise said: “We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.”
In an update at 1:01 a.m. EDT on 17 October (05:01 UTC, 06:01 UK time), it said: “As a protective measure for our Cloud Backup partners and their clients, we are shutting off Cloud Backup application access. This will interrupt backup services for customers until further notice.”
ConnectWise added: “We have no indicators to date that Cloud Backup partner backup data has been compromised. The existing cloud backup archive is not impacted by this service interruption and will be accessible once services are restored.” It has not said how many customers are affected or when the service will return.
What Huntress found
Cloud Backup is used by managed service providers (MSPs) to back up their clients’ Microsoft 365 data, so it is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data. According to Huntress, the app’s credential “is in hostile hands”.
On 15 October, between 06:13 and 08:34 UTC (07:13 to 09:34 UK time), the app’s identity signed in to customer tenants from 144.172.64[.]128, “a hosting provider address”, and received Microsoft Graph access tokens. Legitimate traffic normally comes from Azure private address space. “As of 19:00 UTC on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants,” the company wrote (20:00 UK time). It stresses that the credential works against every tenant where the app is installed, so the attacker is not limited to the tenants it has confirmed.
Huntress describes more serious activity in one customer tenant. On 15 October, between 03:44 and 03:49 UTC (04:44 to 04:49 UK time), a related ConnectWise app, ConnectWise Cloud Management for Microsoft Teams, added itself to the Global Administrator role. A Python script then added new client secrets, set to expire in 2028, to an MSP management app and to Huntress’s own app. Huntress has not tied this earlier activity to the same operator. In roughly 50 tenants it monitors, ConnectWise Cloud Management apps gave themselves directory roles, mostly Exchange Administrator, from 01:58 UTC that day. Huntress says this may have been vendor automation, but it has not confirmed that with ConnectWise.
In an update at 10:30 a.m. ET on 17 October (14:30 UTC, 15:30 UK time), Huntress said it had “high-confidence” that the attacker also abused ConnectWise’s Exchange Online, Microsoft Teams and SharePoint Online Cloud Management apps.
What Microsoft and others say
Microsoft Threat Intelligence characterised the incident as an active supply-chain attack and said it saw unauthorised authentication attempts on 15 October, BleepingComputer reports. BleepingComputer also cites security firm Todyl, which found only sign-in activity in the nine tenants it analysed.
What administrators should do
ConnectWise and Huntress give the same core advice:
- Disable, do not delete. In the Entra admin centre, find the enterprise application with ID
506e08f9-6e9a-4da4-942b-a099a03644ae(also searchable as “SkyKick” or “ConnectWise Cloud Backup”), open Properties and set “Enabled for users to sign-in” to No. Huntress warns that deleting it removes consent, so it would have to be re-consented later. - Check other ConnectWise and SkyKick apps and disable any you cannot verify, without deleting them. In older tenants they may appear as “SkyKick Cloud Manager”.
- Review app credentials. Check the client secrets and certificates on all enterprise applications and app registrations, especially management and security tools, for any added since 13 October that you did not create, and remove anything unexpected.
- Check sign-in logs. Under Monitoring, Sign-in logs, use the Service principal sign-ins tab, filter by the app ID and look for addresses outside Microsoft and Azure ranges, including 144.172.64[.]128.
- Do not re-enable any ConnectWise apps until ConnectWise confirms the credentials have been rotated.
Huntress says a clean log does not rule out access, because directory reads through Microsoft Graph leave no audit trail. Disabling the app pauses backups but does not affect email, files, Teams or sign-ins, and existing backups are not deleted.
What we don’t know
- How the attacker obtained the credential.
- How many tenants were accessed in total. Huntress’s 162 covers only tenants it monitors.
- What data, if any, was taken.
- When ConnectWise will restore the service.
What this means
- A ConnectWise Cloud Backup credential was used to sign in to Microsoft 365 tenants, and ConnectWise has shut off the service until further notice.
- Huntress has confirmed 162 affected tenants among its own customers and, in one tenant, seen a related app make itself Global Administrator and plant new credentials.
- Administrators should disable the app (ID 506e08f9-6e9a-4da4-942b-a099a03644ae) without deleting it, and review any app credentials added since 13 October.
Sources
- ConnectWise Trust Center: Cloud Backup (formerly known as SkyKick) Service Interruption
- Huntress: Vendor credential enables unauthorized access
- Huntress support: 2026 October SkyKick
- BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Related stories
- Google Says Hackers Hijacked AOMEI’s Update Servers in Five-to-Ten-Minute Bursts
- AhsayCBS Backup-Server Flaws Exploited to Plant Webshells and Cryptominers, Huntress Reports
- Microsoft Disrupts Three Chinese-Language Phishing Services It Links to More Than One Billion Scam Messages
- A Cyber Incident at BAE Systems Has Halted Notices From America’s Federal Bankruptcy Courts
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
 credential to access Microsoft 365 tenants. ConnectWise has shut the service off.){kind=link}