ConnectWise Cloud Backup: a vendor credential, and Microsoft 365 tenants

What happened

ConnectWise Cloud Backup (formerly SkyKick) is an application that many managed service providers connect to their customers’ Microsoft 365 tenants. In mid-October 2026 attackers got hold of a credential for that application and used it to sign in to customer tenants as the application itself.

Reported timeline and numbers, with who reported them:

• Security firm Huntress saw failed password guessing from one IP address on 13 and 14 October, and malicious activity on 15 October.
• ConnectWise disabled seven application identities and invalidated shared credentials on 17 October, and suspended Cloud Backup, SaaS Security and Cloud Management.
• Huntress confirmed unauthorized access to at least 162 Microsoft 365 tenants.
• In about 50 tenants Huntress monitors, ConnectWise Cloud Management apps gave themselves directory roles, mostly Exchange Administrator. In one tenant an app made itself Global Administrator and added credentials to other trusted apps.

ConnectWise says its backup archives stay encrypted and isolated and it has no evidence they were accessed. It says the root cause is still under investigation. How the credential was obtained has not been disclosed. I checked these facts as of 19 October; the situation may have moved since.

Why it matters

The attacker never logged in as a person, so multi-factor authentication did not apply. The sign-ins were an application using permissions customers had already granted it. Disabling the app stops new tokens, but tokens already issued can stay valid until they expire. Huntress also noted that Microsoft does not log some application data reads, so absence of evidence is weak here.

Any third-party app you have connected to Microsoft 365 holds standing access to your data, and your exposure depends on how well that vendor protects its own credentials.

What to check

1. In Microsoft Entra, list every enterprise application and app registration that has access to your tenant. Remove those nobody uses, including old SkyKick or backup connections.
2. For each remaining app, review the permissions granted. Ask whether it needs directory-wide write access.
3. Look at service principal sign-ins, not only user sign-ins. The default sign-in view hides them.
4. Look for credentials (secrets or certificates) added to any application since 13 October, and for directory role assignments you do not recognize.
5. If you use ConnectWise Cloud Backup or are an MSP that resold it, follow ConnectWise’s investigation guide and check every customer tenant, including ones with dormant connections.
6. Add an alert for new application credentials and for role assignments to applications.

The reported indicators (IP address, application IDs, user agents) are listed in the BleepingComputer article.