ConnectWise has suspended customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, after attackers compromised application identities tied to the product and used them to breach Microsoft 365 tenants belonging to managed service providers and their clients.
Reports of suspicious activity surfaced on October 17, with administrators flagging unauthorized access to client data linked to a possible SkyKick/ConnectWise breach. Security vendor Huntress confirmed the activity the same day, identifying at least 162 compromised tenants in its monitored environments. Microsoft later confirmed the incident, stating it detected unauthorized authentication attempts from a specific IP address starting on October 15.
How the attack worked
ConnectWise’s Cloud Backup service relies on an application identity, or service principal, in Microsoft Entra ID to access customer Microsoft 365 data for backup and recovery. According to researchers at Todyl, the attacker authenticated directly to Microsoft 365 as the backup application using its secret, inheriting the broad permissions customers had already granted it. Because the sign-ins did not involve a human user login, protections like multi-factor authentication provided no defense.
In the tenants Todyl analyzed, researchers found only sign-in activity with no evidence of new accounts, permission changes, or persistence established through the backup app. However, Huntress observed more aggressive behavior in nearly 50 monitored tenants, where ConnectWise Cloud Management service principals for Exchange Online, Teams, and Microsoft Graph assigned themselves directory roles, primarily Exchange Administrator. In one case, Huntress saw an attacker establish persistence within roughly five minutes, granting a Teams-related service principal Global Administrator rights and adding credentials to an MSP management tool and to Huntress’s own application.
Microsoft separately observed post-authentication persistence via a backdoor, followed by Graph API reconnaissance and attempts to add further credentials. Microsoft Threat Intelligence has classified the incident as an active supply-chain attack, assessing the attacker likely abused existing permissions including Directory.ReadWrite.All.
Indicators and response
All three security vendors traced the activity to the IP address 144.172.64[.]128, with Huntress linking it to scripted sign-ins as early as October 13 using the user agent curl/7.88.1. Other observed user agents include python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.
ConnectWise says it has no indicators that backup data itself was compromised and that existing archives remain intact. The company has disabled application access for partners and clients while it investigates and remediates.
Administrators are urged to review Entra sign-in logs for the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, inspect service principal permission changes and OAuth grants, disable implicated ConnectWise applications, and check for unexpected credential additions, particularly on tenants that may still list the integration under its legacy SkyKick Cloud Manager name.
