A threat actor is said to have used credentials linked to ConnectWise Cloud Backup (formerly SkyKick) to authenticate into Microsoft 365 tenants. ConnectWise began investigating on 14 October and, in response, disabled Cloud Backup for partners and clients on 17 October, with SaaS Security and Cloud Management also taken offline over the weekend as remediation continues.
The incident centers on unauthorized access to application identities used by ConnectWise Cloud Backup, a SaaS backup service for Microsoft 365 data, which can access Exchange, OneDrive, SharePoint, Teams and related workloads. ConnectWise says it has revoked certificates and rotated or disabled compromised identities, and that affected credentials are no longer valid.
Indicators of compromise have been shared with customers, who are advised to review both their own Microsoft 365 tenants and those of any managed partners, including dormant SkyKick connections.
There is some disagreement about the downstream impact. ConnectWise maintains that it has not observed confirmed downstream customer compromise and says it lacks independent visibility into customer Microsoft 365 environments. By contrast, third-party researchers Huntress and Todyl argue that authentication using ConnectWise credentials constitutes downstream impact, with signs of broad sign-in activity across Entra tenants and at least some successful accesses.
Huntress warns organisations to assume the affected Cloud Backup and related apps are unsafe until proven otherwise, check data retention and restore options, and audit credentials for signs of compromise. Todyl goes further, saying all tenants with the ConnectWise Entra application enabled should be treated as compromised. ConnectWise posture remains that mitigations are in place and monitoring continues. Microsoft declined to comment at press time.