CONNECTWISE disclosed that attackers gained unauthorized access by abusing stolen credentials tied to ConnectWise Cloud Backup (formerly SkyKick) application identities. The incident came to light after internal monitoring on 14 October 2026, with seven compromised application identities disabled by 17 October.
ConnectWise states the attack did not involve stolen customer passwords; instead, the threat actors used the vendor’s own application permissions to request access tokens from Microsoft Entra ID and potentially interact with customer Microsoft 365 environments.
Depending on the permissions granted to each affected application, the attackers could access mailboxes, SharePoint documents, Teams messages, and directory data. Disabling the compromised connections stops new authentication through those connections but does not automatically reverse changes already made inside a tenant. In other words, the attackers could have performed actions before containment that might persist after remediation.
Moreover, the adversary could add a new client secret to an existing trusted application or register a new one, creating a secondary access path that would remain even after the original vendor credential is revoked.
Huntress’s analysis notes a broader risk: if an attacker obtains directory roles, they can grant themselves permissions, reset credentials, alter policies, and effectively regain access. Huntress reported malicious sign-ins from IP 144.172.64[.]128 around 14:20 UTC on 15 October, with a second targeted wave later that day hitting 16 tenants in sensitive sectors; all 16 attempts failed.
About 1,000 Entra tenants logged the IP, roughly 300 sign-ins succeeded, but some were blocked by missing service principals or tenant configuration. ConnectWise says Cloud Backup archives remain encrypted, isolated, and preserved, though backups are offline and restoration is unavailable. Organisations using ConnectWise Cloud Backup or Cloud Management are advised to audit both their own and managed customers’ tenants and preserve sign-in logs for forensic purposes.