Overview
ConnectWise is investigating unauthorized access involving application identities associated with ConnectWise Cloud Backup, formerly SkyKick Backup. The company publicly disclosed the incident on October 16, 2026. On October 17, it disabled seven application identities associated with Cloud Backup and Cloud Management and revoked certificates used for affected Cloud Backup connections.
According to Microsoft Threat Intelligence, the threat actor used the compromised OAuth application to obtain access tokens across customer tenants, likely abusing previously granted permissions, including elevated permissions such as Directory.ReadWrite.All. Microsoft observed suspicious service-principal authentication, Microsoft Graph reconnaissance, and attempts to add credentials for persistent access.
ConnectWise reports no evidence that its encrypted backup archives were accessed. However, this finding does not establish whether unauthorized activity occurred inside customers’ Microsoft 365 environments. Cloud Backup remains suspended, including scheduled backups and access to affected restoration capabilities.
Cynet’s Response
Cynet’s Research and CyOps teams are investigating available Microsoft 365 and Entra ID telemetry for activity associated with the affected application and reported indicators. The investigation focuses on suspicious application authentication and, where relevant telemetry is available, unexpected credentials, OAuth permission changes, and privileged role assignments that could indicate persistent access.
Known indicators were incorporated into Cynet’s detection engines to support identification of related suspicious activity. Investigation coverage depends on each customer’s enabled integrations and available logs.
Disabling the original application does not remove unauthorized access already established through other identities. Organizations using the affected ConnectWise integrations should keep affected applications disabled in accordance with ConnectWise guidance, preserve available logs, and review their tenants for unauthorized credentials, permissions, and other changes.
Cynet continues to monitor developments and investigate new indicators as additional information becomes available.
ConnectWise Cloud Backup Incident Timeline
All times are UTC. Update timestamps indicate publication time unless an action time is explicitly stated.
October 14, 2026
- ConnectWise states it identified the issue and promptly initiated investigation and incident-response activities.
October 16, 2026 – 17:47 UTC
- ConnectWise publicly disclosed attempted unauthorized access associated with Cloud Backup.
- Published the source IP and user-agent indicators.
- Reported no indication that partner backup data had been accessed.
October 17, 2026 – 05:01 UTC
- ConnectWise announced it was shutting off Cloud Backup application access, interrupting backup services.
- Published guidance for reviewing service-principal sign-ins.
October 17, 2026 – 07:00 UTC
- ConnectWise disabled seven application identities associated with Cloud Backup and Cloud Management, according to its subsequent advisory.
October 17, 2026 – 17:00 UTC update
- ConnectWise confirmed it had suspended Cloud Backup and revoked certificates used for affected connections.
- Stated that the affected shared credentials were no longer valid.
- Reported that backup archives remained encrypted and isolated, with no evidence of archive access; restoration remained unavailable.
- Clarified that these findings did not establish whether customer Microsoft 365 tenants had experienced unauthorized activity.
October 18, 2026 – 01:00 UTC update
- ConnectWise published expanded tenant-investigation guidance.
- Recommended preserving logs and reviewing credentials, federation trusts, roles, owners, consent grants, policy changes, and mailbox configurations.
- Emphasized that disabling affected connections does not reverse prior tenant changes or remove access established through other identities.
Key points:
– The activity involved unauthorized access to Cloud Backup application identities, ConnectWise identified suspicious service-principal authentication.
– ConnectWise disabled seven affected identities and revoked the certificates used for their application connections.
– Disabling access prevents new authentication but does not undo changes that may already have occurred within a Microsoft 365 tenant. Previously issued tokens may also remain valid until expiration or revocation.
– Organizations using ConnectWise Cloud Backup should review Entra service-principal sign-ins, consent and permission changes, unusual OAuth applications, and activity from unexpected IP ranges.
Indicators Of Compromise (IOCs):
Application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae
Application Name: ConnectWise Cloud Backup / SkyKick Backup
Publisher name: SkyKick
IP Address: 144[.]172.64.128
User Agents: Python-urllib/3.12, python-requests/2.31
Action Items Taken by CyOps:
- Review application authentication: Investigate authentication events associated with application ID 506e08f9-6e9a-4da4-942b-a099a03644ae across all customers for the past 30 days, using available telemetry.
- Review activity from the reported IP: Investigate authentication events originating from 144[.]172.64.128 across all customers during the same period.
- Identify potentially affected customers: Locate customer Entra ID tenants containing the ConnectWise Cloud Backup application, formerly SkyKick Backup, and review available logs for unusual activity over the past 30 days.
- Update detection coverage: Add the reported indicators of compromise (IOCs) to Cynet’s detection engines to flag related suspicious activity.
Cynet continues to monitor developments and investigate new findings related to this Entra ID application compromise. Our response combines available Microsoft 365 and Entra ID telemetry with targeted investigation, focusing on:
- Suspicious application authentication: Service-principal sign-ins involving the affected application, the reported malicious IP address, or other unexpected sources.
- Potential persistence mechanisms: Unauthorized additions of application credentials, OAuth consent grants, permission changes, and privileged role assignments.
- Additional access paths: Activity involving related identities or other applications that could indicate continued unauthorized access beyond the original compromised application.
As the full scope of the incident remains under investigation, Cynet is also monitoring the following ConnectWise Microsoft Entra applications for potentially related suspicious activity:
- ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
- Cloud Management – MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
- Cloud Management – Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
- Cloud Management – MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
- Cloud Management – Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
- Cloud Management – SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
ConnectWise has chosen to disable them all for the time being
ConnectWise Advisory: https://www.connectwise.com/company/trust/advisories
Cynet customers and partners can also proactively hunt for suspicious application authentication through Cynet SIEM. Where the relevant Entra ID service-principal logs are collected and retained, customers can search for the affected application IDs and reported source IP address, then review authentication results, timestamps, and unexpected source locations to identify activity requiring further investigation:
Recommended Actions for Organizations Using Affected ConnectWise Integrations
- Verify application status: Keep affected Enterprise Applications disabled until ConnectWise provides restoration instructions. Match applications by AppId, including older SkyKick integrations.
- Preserve evidence: Export available sign-in and audit logs promptly without delaying urgent containment.
- Investigate authentication: Review Entra service-principal sign-ins alongside user sign-ins from October 13, 2026 onward. Extend searches to October 1 where available. Investigate unexpected sources beyond the published IOCs.
- Review persistence mechanisms: Inspect application registrations and service principals for unauthorized secrets, certificates, federation trusts, owners, consent grants, permissions, and directory roles. Include other trusted applications.
- Investigate tenant changes: Review application updates, policy changes, new accounts, and authentication-method changes. Preserve findings and remove confirmed unauthorized access with an authorized responder.
- Check Microsoft 365 activity: Investigate unexpected mailbox forwarding, inbox and transport rules, delegated mailbox access, and suspicious resource activity.
- Cover every relevant tenant: MSPs should review their own tenant and managed customer tenants, including dormant integrations.
Disabling the original applications does not remove access established through other identities. Escalate suspicious findings to your security team or incident-response provider.
ConnectWise Official Sources:
https://www.connectwise.com/company/trust/advisories
https://status.connectwise.com/pages/incident/619cf82551fec9053d612f09/6ad263692dc48705ab3da2cb