Cybersecurity Alert: ConnectWise Cloud Backup Security Breach

Recent cybersecurity investigations have uncovered a serious breach involving the ConnectWise Cloud Backup application, previously known as SkyKick. Attackers are reportedly exploiting compromised Microsoft 365 (M365) credentials linked to this service to access the M365 environments of various customers without authorization.

Overview of the Incident

ConnectWise Cloud Backup is designed as a backup and recovery tool tailored for managed service providers (MSPs), safeguarding clients’ data within Microsoft 365 and Google Workspace. It requires extensive permissions, allowing it access to crucial services including mailboxes, OneDrive, SharePoint, Teams, and directory data from all tenant accounts where it is deployed.

Extent of Unauthorized Access

The cybersecurity firm Huntress reported that they detected unauthorized sign-ins across 173 partner and customer tenants via the compromised credential. This effectively places every organization utilizing the app at risk as the credentials are valid across all tenants where the application has been granted permissions.

Details on the Attack Method

Security researcher Jonathan Semon highlighted that the malicious actors were observed using Microsoft Graph tokens obtained from the compromised credential, during a specific time frame on October 15, 2026. The attackers appeared to execute their actions through a script, systematically accessing tenants in a pre-defined order.

Broader Implications of the Breach

In their analysis, Huntress noted that the same attackers were detected performing a password spraying attack on several law firm accounts shortly before the broader breach. Additionally, in at least one instance, the compromised ConnectWise app elevated its own privileges to Global Administrator, thereby posing a severe threat to customer security.

ConnectWise Response

In the wake of these revelations, ConnectWise has temporarily suspended access to the Cloud Backup application. They have stated that no partner backup data has been confirmed as compromised. Furthermore, the company has released guidance to help organizations identify signs of compromise, including:

• Monitoring sign-in logs in the Microsoft Entra Admin Center.
• Scrutinizing authentication activity for unusual IP addresses.

Observations noted the suspicious IP address 144.172.64[.]128 as a source of compromised access.

Recommendations for Affected Organizations

Organizations using ConnectWise Cloud Backup are advised to take immediate action, including:

• Disabling the application until credential resets are confirmed by ConnectWise.
• Reviewing Microsoft Graph activity logs for unusual activities.
• Auditing system logs for unauthorized credential changes after October 13, 2026.

Context of Broader Cybersecurity Threats

This incident follows a reported campaign of “ephemeral supply chain tampering” involving AOMEI Backupper and highlights the increasing vulnerability of backup services to sophisticated cyber attacks. Recent reports from Google Threat Intelligence and Microsoft have underscored a worrying trend within the cybersecurity landscape involving exploitation of legitimate tools for malicious purposes.

Conclusion

The ConnectWise Cloud Backup breach serves as a stark reminder of the vulnerabilities inherent in widely-used cloud services. As investigations are ongoing, organizations must prioritize their security measures and remain vigilant against potential threats.

(This situation is evolving; updates will be provided as new information becomes available.)