Imagine your backup tool, the safety net you trust after a cyberattack, turning into the way attackers walk into your data. That is exactly what happened this month with ConnectWise Cloud Backup. Attackers took over the application identity behind the service and used it to sign in to Microsoft 365 tenants across the world.
Huntress, Todyl, and Microsoft have all confirmed parts of the story, and the victim list keeps growing. Here is what happened, how the attack worked, and what every Microsoft 365 admin should check today.
What happened in the ConnectWise Cloud Backup attack
ConnectWise Cloud Backup, formerly known as SkyKick Cloud Backup, is a popular service among managed service providers (MSPs) and IT teams. It backs up emails, files, and chats from Microsoft 365 and Google Workspace so companies can restore data after an incident.
On October 15, 2026, things went wrong. Microsoft says it spotted unauthorized authentication attempts coming from a single IP address. Around the same time, administrators on Reddit reported a strange alert from Microsoft Privileged Identity Management (PIM). A SkyKick service principal was assigning itself the Exchange Administrator role, even though some of those tenants had not used the app in years.
By Friday, Huntress confirmed the worst. It found at least 162 compromised tenants in the environments it monitors. Microsoft also confirmed malicious activity involving the ConnectWise Cloud Backup service, and Todyl published its own investigation findings.
ConnectWise responded by shutting down customer access to its Cloud Backup application at 05:01 UTC on October 17. The company says it has no evidence that stored backup archives were compromised, and that existing backups will be available again when the service returns. At the time of writing, no restoration timeline has been announced.
How the attackers got into Microsoft 365 tenants
The attackers did not break passwords or bypass multi-factor authentication in the usual way. They did something simpler and more dangerous.
- The app itself was the identity. For Microsoft 365 backups, the service uses a “service principal” inside each customer’s tenant. That application identity carries the permissions customers granted it over time.
- They used the app secret. Todyl says the attacker authenticated directly to Microsoft 365 as the backup application using its secret. The sign-in requests came from an automated script with no user login involved.
- MFA could not help. Because nobody typed a password, multi-factor authentication never triggered. The app already held broad, previously granted permissions.
- The permissions were wide open. Those permissions gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.
Researchers tied the malicious traffic to one IP address: 144.172.64[.]128. Huntress also linked scripted sign-in attempts on October 13 and 14 to the user agent curl/7.88.1. Other sign-ins used python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.
What researchers found inside compromised tenants
The three security firms saw slightly different pictures, which is normal in a live incident.
- Huntress: Beyond the 162 compromised tenants, it saw ConnectWise Cloud Management apps (Exchange Online, Microsoft Teams, and Microsoft Graph) assigning themselves directory roles, mostly Exchange Administrator, on nearly 50 tenants. In one tenant, the attacker established persistence in about five minutes. In another, the Cloud Management Teams app granted itself the Global Administrator role and added credentials to an MSP management tool.
- Todyl: In nine tenants, it found only sign-in activity. No accounts were created, no passwords changed, and no persistence was planted through the backup app.
- Microsoft: Its threat intelligence team called this an active supply-chain attack and observed backdoor persistence after service principal authentication, followed by Microsoft Graph API reconnaissance and attempts to add more credentials.
All three firms agree on the entry point and the attacker IP. What remains unclear is how the attacker obtained the vendor credentials in the first place, and how much data was actually stolen.
For Indian companies this hits close to home. Thousands of MSPs and IT service firms in India manage Microsoft 365 for their own clients using exactly these kinds of backup integrations. If your IT provider used ConnectWise Cloud Backup, your tenant exposure is tied to their security, not just yours. Ask them directly which application IDs they deployed and when they disabled the service.
This is also a textbook example of why security teams now track vendor application identities as attack surface. A stolen API secret for a backup app can reach more data than a phished user password ever will.
Signs your tenant may have been targeted
There are concrete indicators to look for. The legitimate Cloud Backup application ID used in the attack is 506e08f9-6e9a-4da4-942b-a099a03644ae. Older tenants may list the Cloud Management apps under the name “SkyKick Cloud Manager”.
The full list of application IDs to check in Entra:
- ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
- ConnectWise Cloud Management – MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
- ConnectWise Cloud Management – Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
- ConnectWise Cloud Management – MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
- ConnectWise Cloud Management – Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
- ConnectWise Cloud Management – SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
Red flags include service principals signing in from unfamiliar addresses, apps assigning themselves directory roles without a request from your team, and new credentials appearing on applications between October 13 and 17.
What IT admins should do right now
ConnectWise shutting down the application does not remove credentials already planted in your tenant. Take these steps today:
- Check service principal sign-ins. In Entra, filter sign-in logs by the Cloud Backup application ID and look for unexpected source addresses.
- Disable the implicated ConnectWise applications. Huntress advises turning them off while you investigate.
- Review application credentials. Huntress says to audit secrets and certificates across all applications for anything added since October 13 and delete those entries.
- Review OAuth grants and Graph activity. Microsoft recommends checking application credential changes and anything done through the Graph API.
- Understand the token problem. Todyl warns that disabling an application stops new tokens from being issued, but existing tokens stay valid until they expire. Revoking user sessions does not end application-based access.
- Check other Cloud Management integrations. The attacker showed interest in more than the backup app, so treat every ConnectWise integration as suspect until cleared.
- Keep a timeline. Write down when you disabled the apps and what you found. If data was taken, MSPs owe their clients an incident report, and the details start here.
One more point for MSPs. Your clients will ask questions, and they should. The safest answer is a factual one: what the app could reach, what you checked, and what you found. Silence in a supply-chain incident is what turns a security problem into a business problem.
FAQ
What is the ConnectWise Cloud Backup breach?
Attackers compromised the application identity behind ConnectWise Cloud Backup (formerly SkyKick) and used it to authenticate to Microsoft 365 tenants without any user login. ConnectWise shut down the service on October 17 and launched an investigation.
How many Microsoft 365 tenants were affected?
Reporting points to at least 173 compromised tenants so far, including 162 identified by Huntress. The final victim count is still being established as more MSPs and tenants complete their checks.
Does multi-factor authentication stop this kind of attack?
No. The attacker signed in as the application itself using its secret, with no user involved. MFA protects user sign-ins, not application identities, which is why app credential hygiene matters so much.
Is my Microsoft 365 backup data safe?
ConnectWise says there are no indicators that stored Cloud Backup archives were compromised. However, the live tenant data the app could reach, including mail, files, and chats, should be treated as potentially accessed.
How do I check if my tenant was hit?
Search your Entra sign-in logs for the Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, review credentials added to your applications since October 13, and look for role assignments made by ConnectWise Cloud Management apps.
