A compromised application credential belonging to ConnectWise Cloud Backup, formerly known as SkyKick, has been used in a supply chain attack targeting Microsoft 365 environments. The attackers exploited the permissions granted to the backup service to authenticate directly to customer tenants, obtain Microsoft Graph access tokens, and, in at least one documented case, establish persistent access through other trusted applications.
The incident poses a particular risk to managed service providers (MSPs) and their customers, as the affected applications can hold extensive permissions across multiple Microsoft 365 environments. By compromising a trusted application identity, the attackers were able to bypass the need for individual user credentials or MFA verification.
ConnectWise has acknowledged the incident and implemented containment measures. As of October 18, seven related application identities have been disabled, while Cloud Backup, Cloud Management, and SaaS Security services remain temporarily unavailable.
The company reports no evidence that its stored backup archives were accessed. However, the extent of unauthorized activity within individual customer environments remains under investigation.
How the SkyKick Compromise Worked
ConnectWise Cloud Backup is a cloud-based backup and recovery service that allows MSPs to protect customer data across Microsoft 365 environments. To perform these functions, the application requires permissions to access services such as Exchange Online, SharePoint, OneDrive, and Microsoft Teams.
The attackers exploited this trusted relationship by using a compromised application credential to authenticate directly to customer tenants.
On October 15, unauthorized authentication activity was detected from the IP address 144.172.64[.]128. The compromised Cloud Backup application successfully obtained Microsoft Graph access tokens, allowing the attacker to operate with the permissions already granted to the service.
Unlike traditional account compromise, this attack did not require the theft of individual user passwords. The authentication took place through the application’s own identity, meaning standard MFA protections for user accounts would not prevent access.
The activity also appeared automated, with authentication requests made against multiple tenants within a short period.
The potential impact is significant. Depending on the permissions granted to the application, an attacker could gain access to sensitive emails, documents, Teams communications, and directory information.
Importantly, successful authentication does not necessarily confirm data theft. The full extent of access and any subsequent data exfiltration has not yet been established.
Attack Timeline
| Date (UTC) | Key Development |
| October 13–14 | Password-spraying attempts were observed against four law firm tenants from infrastructure later associated with the incident. |
| October 14 | ConnectWise identified suspicious activity and initiated its incident response process. |
| October 15 | Unauthorized authentication activity involving ConnectWise applications was observed across Microsoft 365 tenants. |
| October 15 | In one documented case, a ConnectWise application elevated itself to Global Administrator and added credentials to two other applications. |
| October 15, 06:13–08:34 | The compromised Cloud Backup identity authenticated to customer tenants from 144.172.64[.]128 and obtained Microsoft Graph tokens. |
| October 16 | ConnectWise publicly acknowledged the incident and began implementing containment measures. |
| October 17 | ConnectWise disabled seven associated application identities and suspended affected services. |
| October 18 | ConnectWise confirmed that its investigation remained ongoing and advised customers to review their Microsoft 365 environments for suspicious activity. |
Privilege Escalation and Persistence Through Trusted Applications
The attack was not limited to unauthorized authentication through the compromised backup service. Investigators also identified activity involving ConnectWise Cloud Management for Microsoft Teams, tracked under application ID 24205314-2b89-4e07-a2a4-579e898a5640.
In one documented tenant, the application assigned itself the Global Administrator role before modifying two other trusted applications.
The attacker added new client secrets to both applications, with expiration dates extending into 2028. An additional attempt to introduce a certificate-based credential was unsuccessful.
These changes created a potential persistence mechanism independent of the original compromised application. By adding credentials to existing applications, the attacker could potentially authenticate through those identities using their previously granted permissions.
This activity is consistent with MITRE ATT&CK T1098.001 – Additional Cloud Credentials, a technique in which attackers establish or maintain access by introducing new credentials into existing cloud identities.
The persistence mechanism also complicates remediation. Disabling the original ConnectWise application does not automatically remove unauthorized credentials that may have been added to other applications.
Some related application activity also originated from Azure private IPv6 infrastructure rather than the publicly identified suspicious IP address. Consequently, investigations should not rely exclusively on a single network indicator.
These findings highlight the broader risk associated with highly privileged third-party applications. When an attacker compromises a trusted application identity, the resulting access can extend beyond the original service and potentially affect other connected applications.
Indicators of Compromise
The following indicators have been associated with the attack and can assist security teams in identifying suspicious activity.
| Indicator | Value |
| Suspicious source IP | 144.172.64.128 |
| Compromised application | ConnectWise Cloud Backup / SkyKick |
| Primary application ID | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| Associated user agents | Python-urllib/3.12, python-requests/2.31, curl/7.88.1 |
| Observed activity window | October 13–16, 2026 |
| Primary log source | Microsoft Entra service principal sign-in logs |
| Additional log sources | Entra audit logs, Microsoft Purview Audit, and available Microsoft Graph activity logs |
These indicators should be evaluated alongside authentication behavior, application permissions, and configuration changes. Common scripting user agents are not inherently malicious, while additional attacker activity may originate from infrastructure outside the identified IP address.
ConnectWise Applications Requiring Review
ConnectWise confirmed that it disabled the following seven application identities on October 17. Organizations should verify that the corresponding applications are also disabled within their own Microsoft 365 tenants.
| Application | Application ID |
| Cloud Backup / SkyKick | 506e08f9-6e9a-4da4-942b-a099a03644ae |
| Cloud Management | 2399d300-6fca-4e6a-a686-399fefe75b83 |
| Cloud Management – MS Teams | 24205314-2b89-4e07-a2a4-579e898a5640 |
| Cloud Management – Exchange Online | b78f6a77-d4e5-46fb-87e5-d1648bd02519 |
| Cloud Management – MS Graph | 0de14c77-b9b0-4137-9360-34878a929827 |
| Cloud Management – Partner Center | 412dcf96-176d-4b3a-a1b0-4981ad66971e |
| Cloud Management – SharePoint Online | b2b55f5b-7758-4719-8d8f-88ae172e6bdb |
Older installations may display SkyKick Cloud Manager naming conventions. Administrators should therefore identify applications using their application IDs rather than relying solely on display names.
Recommended Mitigation and Response
Organizations using ConnectWise Cloud Backup or related Cloud Management integrations should review their Microsoft 365 environments for potentially unauthorized authentication and application changes.
1. Verify that affected applications are disabled. Review the listed applications in Microsoft Entra ID and ensure they cannot authenticate within customer tenants. Preserve the application configurations and associated evidence rather than immediately deleting them.
2. Investigate application credentials and permissions. Review recently added client secrets, certificates, federated credentials, privileged role assignments, application owners, and OAuth consent grants. Pay particular attention to changes made since October 13.
3. Check for secondary persistence. Investigate other privileged applications, including MSP management platforms, security tools, and backup integrations. Unauthorized credentials added to these applications may provide continued access even after the original ConnectWise connection has been disabled.
4. Review authentication and audit logs. Examine Microsoft Entra service principal sign-ins and audit events for suspicious authentication, unexpected role assignments, and application credential modifications. Extend the investigation beyond the published IP address where possible.
5. Assess potential data exposure. Review available Exchange Online, SharePoint, OneDrive, and Microsoft 365 audit records for unauthorized access or unusual activity. Investigate unexpected mailbox forwarding, delegated permissions, and changes to application access.
ConnectWise has revoked certificates used by the affected application connections, preventing new authentication through those credentials. However, previously issued access tokens may remain valid until they expire or are invalidated. Any additional credentials established through other applications must also be investigated and removed.
Stay Safe. Stay Secure.
OP Innovate Research Team
