ConnectWise Cloud Backup Compromise: What Microsoft 365 Customers Need to Know

Published: Mon 19 October 2026

Prepared by: Matt Veall, SOC Lead - Victoria 

Last week, attackers used a stolen ConnectWise application credential to sign in to Microsoft 365 tenants around the world, with the incident coming to light over the weekend. Here's what happened, why it may affect you even if you have never heard of SkyKick, and what we recommend you check this week.

What's Happening

Late last week, ConnectWise confirmed unauthorised access to application identities within its Cloud Backup environment. Cloud Backup, formerly SkyKick Cloud Backup, is used mostly by managed service providers (MSPs) to back up Microsoft 365 email, OneDrive, SharePoint and Teams data for their clients.

The attacker used a stolen credential belonging to the Cloud Backup application to sign in directly to customer tenants. Because the sign-ins were made as the application rather than as a user, multi-factor authentication and user-based Conditional Access did not apply. Huntress has confirmed unauthorised sign-ins in at least 162 tenants and has seen sign-in activity from the attacker's IP address against almost 1,000 tenants, more than 300 of them successful. Microsoft has described the activity as an active supply chain attack. In one tenant, a second ConnectWise application granted itself Global Administrator and added new client secrets, valid until 2028, to two other trusted applications, giving the attacker a way back in that would survive ConnectWise resetting its own credentials. ConnectWise Cloud Management applications were also seen assigning themselves directory roles, mostly Exchange Administrator, in around 50 tenants.

ConnectWise has since disabled seven of its application identities and taken Cloud Backup offline for all customers. Scheduled backups are not running and no restoration date has been given. ConnectWise says it has no indication that stored backup data was accessed, but it has not said how the credential was stolen, and the activity has not been attributed to any known threat actor.

Why This Matters for Your Organisation

You may be exposed without realising it. Cloud Backup is sold almost entirely through MSPs, so the application is often consented by an IT provider on a client's behalf, and it frequently stays in the tenant long after the service is cancelled. The stolen credential worked against every tenant where the application was present, whether it was still in use or not.

ConnectWise has also said it has no visibility into customer tenants, so it cannot tell you whether yours was accessed. That can only be confirmed from your own logs. If you currently rely on Cloud Backup, be aware that nothing is being backed up by that service until it comes back online, and restores are unavailable.

Key concern: Tenants without Entra ID P1 or P2 licensing only keep sign-in and audit logs for seven days, and the earliest related activity dates back to 13 October, so that evidence will start disappearing within the next day. Buying a licence now will not bring it back. If your Entra logs are not already going to a SIEM, download them from the Entra admin centre today.

Timeline of Events

The following timeline is drawn from ConnectWise, Microsoft and Huntress reporting and may be revised as the investigations continue. Times are given in UTC, with AEDT in brackets.

13-14 Oct 2026   Initial activity - Scripted password spray attempts from the attacker's IP address against a small number of tenants.

15 Oct 2026   Tenant sign-ins - The Cloud Backup application signs in to customer tenants from 144.172.64[.]128, with the main burst between 06:13 and 08:34 UTC (17:13 to 19:34 AEDT). Related activity, including applications assigning themselves directory roles, was seen from about 01:00 UTC on 15 October until 02:00 UTC on 16 October.

16 Oct 2026   Public disclosure - Huntress raises the alarm publicly. ConnectWise publishes its first advisory.

17 Oct 2026   Containment - ConnectWise disables seven application identities, revokes certificates and shuts down Cloud Backup access. Microsoft Threat Intelligence describes the activity as an active supply chain attack.

18-19 Oct 2026   Services offline - Backups remain offline. ConnectWise SaaS Security and Cloud Management are also taken offline as a precaution.

Are You Affected

Check whether any of the following applications exist in your tenant. In older tenants they may appear under SkyKick names. Their presence means you were exposed, not necessarily that you were compromised.

The primary attacker IP address is 144.172.64[.]128, reported by ConnectWise, Microsoft and Huntress. Additional addresses on the same hosting provider (144.172.94[.]243, 2602:fa59:13:5f::1 and 2602:fa59:2:3559::1) have been reported by one vendor but are not yet confirmed by other sources. Blocking these addresses at your firewall will not help, as the sign-ins go directly to Microsoft's cloud. Legitimate Cloud Backup traffic comes from Microsoft Azure private address space, so any sign-in by these applications from elsewhere is worth investigating, although an Azure source on its own does not rule out malicious activity.

How Our SOC is Responding

Our 24/7 MDR service already monitors Microsoft Entra ID and Microsoft 365 activity across managed environments. In response to this incident, our SOC has taken the following additional steps:

• Service Principal Privilege Escalation - Detection for applications assigning privileged directory roles, such as Global Administrator or Exchange Administrator, to themselves or other applications.

• Application Credential Monitoring - Alerting on new client secrets and certificates added to applications, particularly where added by another application or set with an unusually long expiry.

• Threat Intelligence Watchlists - The indicators in this advisory have been added to our watchlists and will be updated as new indicators are published.

Current status: ConnectWise's investigation is ongoing and the full extent of data access is not yet known. If we identify matching activity in your environment, we will contact you directly through our standard incident process.

Recommended Actions for Your Organisation

We recommend the following steps be prioritised this week. If an MSP manages your Microsoft 365 tenant, please share this advisory with them and agree who is doing what:

1. Preserve Your Logs - Export Entra ID sign-in logs (including service principal sign-ins), Entra audit logs and the Microsoft Purview Unified Audit Log from 13 October onwards before they age out.

2. Check for the Affected Applications - In the Microsoft Entra admin centre, go to Enterprise applications, set the filter to All applications and search for each application ID above, as well as "ConnectWise" and "SkyKick". If an MSP set up your backups, ask them whether either product was ever used.

3. Disable, Do Not Delete - Set "Enabled for users to sign-in?" to No on each application. This stops new tokens being issued while keeping the audit trail and consent intact, although tokens already issued can remain valid for up to about 90 minutes. Revoking user sessions will not affect application access. Disabling also does not undo any roles or credentials the attacker has already added, which is why steps 5 and 6 matter. Keep the applications disabled until ConnectWise confirms all credentials have been rotated.

4. Review Service Principal Sign-ins - Filter the service principal sign-in logs by each application ID and look for activity from the IP addresses above or from outside Microsoft Azure. A successful sign-in from 144.172.64[.]128 should be treated as confirmed unauthorised access and investigated as an incident.

5. Look for New Credentials on Every Application - Review all applications in your tenant, not just the ConnectWise ones, for client secrets or certificates added since 13 October. Be especially wary of credentials added by an application rather than a named administrator, or with an expiry years into the future.

6. Audit Privileged Role Assignments - Review Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Application Administrator, Cloud Application Administrator and Exchange Administrator assignments, including eligible assignments in Privileged Identity Management. Remove any role held by a ConnectWise, SkyKick or unrecognised application.

7. Reduce Third-Party Application Exposure - Remove consents for any third-party application with tenant-wide access that you no longer use, and reduce the permissions of those you keep to the minimum needed. Conditional Access for workload identities cannot restrict third-party multi-tenant applications such as ConnectWise's, so regular review of what has been consented in your tenant is the main control here.
   
   

Resources

• Cloud Backup incident status updates - ConnectWise

  https://status.connectwise.com/

• Trust Center Advisories - ConnectWise

  https://www.connectwise.com/company/trust/advisories

• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks - Huntress, 16 October 2026 (updated 17 October)

  https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

• Post on X regarding ConnectWise Cloud Backup - Microsoft Threat Intelligence (@MsftSecIntel), 17 October 2026

  https://x.com/MsftSecIntel/status/2111358888125878426

• Alerts and advisories for Australian organisations - Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)

  https://www.cyber.gov.au/