ConnectWise SkyKick Credential Abuse Hits 173 Microsoft 365 Tenants

ConnectWise SkyKick: Compromised Credential Hits 173 M365 Tenants | 2026

Executive Summary

Unknown threat actors used a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup, formerly SkyKick, on October 15, 2026, to access customer environments where the application was installed. Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants, making this a serious software supply-chain and cloud identity incident rather than a routine product outage.

The application is designed to back up Microsoft 365 data and therefore can hold broad permissions across Exchange mailboxes, OneDrive, SharePoint, Teams, and directory services. Organizations that installed the app should disable it until ConnectWise confirms credential rotation, preserve evidence, review Microsoft Entra activity, and investigate any new application roles or credentials.

So what? A trusted SaaS identity can inherit the access already granted to it across many tenants. The first response priority is to contain that identity and determine whether attackers used its permissions to read data or change tenant configuration.

What happened?

The incident, as currently reported, involves the ConnectWise Cloud Backup application identity rather than a vulnerability exploited directly on each customer’s network.

Timeline

• October 13, 2026: Huntress recommends reviewing Microsoft Entra activity from this date onward for suspicious ConnectWise or SkyKick application actions.
• October 15: Huntress observed the Cloud Backup application identity authenticating to customer tenants from 144.172.64[.]128, a hosting-provider address that is not consistent with the application’s normal Azure private-network traffic.
• October 16: Huntress reported 162 confirmed unauthorized sign-ins and ConnectWise acknowledged unauthorized access to application identities in its Cloud Services environment.
• October 17: Public reporting put the confirmed tenant count at 173. ConnectWise said it had shut off Cloud Backup application access as a protective measure and had no current indication that hosted backup archives were compromised.

The exact scope of data access, the identity of the threat actors, and the full intrusion path remain unconfirmed. A successful application sign-in proves authentication activity, but it does not by itself prove that every accessible mailbox, file, or Teams resource was read.

Who is affected?

Potentially affected organizations are Microsoft 365 tenants with ConnectWise Cloud Backup, formerly SkyKick Backup, installed and consented. The application appears in Microsoft Entra as ConnectWise Cloud Backup or SkyKick Backup, with application ID 506e08f9-6e9a-4da4-942b-a099a03644ae.

Managed service providers are especially exposed because one partner may administer the application across many customer tenants. A second application, ConnectWise Cloud Management - MS Teams, was also associated with suspicious activity in one Huntress investigation; its application ID is 24205314-2b89-4e07-a2a4-579e898a5640.

Organizations that uninstalled the product years ago should still verify whether the enterprise application, service principal, delegated consent, or residual role assignment remains in their tenant.

Initial access and kill chain

The currently supported chain is:

1. An attacker obtained or abused a vendor-side credential associated with the ConnectWise Cloud Backup service principal.
2. The attacker authenticated to customer Microsoft 365 tenants where the application had already been granted consent.
3. Microsoft Entra issued access tokens for the service identity.
4. The identity could request Microsoft Graph access within the permissions previously granted to the application.
5. The attacker may have used those permissions to access mail, files, Teams data, directory information, or to modify application roles and credentials. The extent of this activity remains under investigation.

This is a credential theft and trusted-relationship abuse scenario. It does not require a user to enter a password, and customer MFA does not necessarily block a compromised vendor service principal.

MITRE ATT&CK alignment

Technique	Relevance
T1078 - Valid Accounts	A compromised vendor credential was reportedly used to authenticate as a legitimate application identity.
T1098 - Account Manipulation	Huntress reported suspicious application role and credential changes in one partner tenant.
T1528 - Steal Application Access Token	Access tokens issued to the service principal could enable Graph activity within its consented scope.
T1530 - Data from Cloud Storage Object	OneDrive, SharePoint, and other cloud data may be reachable if included in the application’s permissions.
T1087.004 - Account Discovery: Cloud Account	Directory permissions can expose tenant and identity information during investigation or follow-on activity.

Indicators and detection

Microsoft Entra and Microsoft Graph

• Search sign-in logs for ConnectWise Cloud Backup or SkyKick Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae from October 13 onward.
• Investigate sign-ins from 144.172.64[.]128 and any unexpected non-Azure source infrastructure.
• Review service-principal sign-ins, consent changes, directory-role assignments, new secrets, and certificate additions.
• Search for the ConnectWise Cloud Management - MS Teams application ID 24205314-2b89-4e07-a2a4-579e898a5640 and validate every role or credential change.
• Preserve sign-in, audit, Graph activity, mailbox, SharePoint, OneDrive, and Teams logs before retention windows expire.

Example Microsoft Sentinel KQL pattern:

let suspiciousApps = dynamic([
  "506e08f9-6e9a-4da4-942b-a099a03644ae",
  "24205314-2b89-4e07-a2a4-579e898a5640"
]);
SigninLogs
| where TimeGenerated >= datetime(2026-10-13)
| where AppId in (suspiciousApps)
   or IPAddress == "144.172.64.128"
| project TimeGenerated, UserPrincipalName, AppDisplayName, AppId,
          IPAddress, ResultType, ResultDescription, ResourceDisplayName
| order by TimeGenerated desc

The query is an example detection pattern. Adapt field names and data sources to the tenant’s Microsoft Sentinel and Entra schema.

Endpoint, email, and network telemetry

• Search for mailbox access, unusual message reads, forwarding-rule creation, OAuth consent, mass downloads, and abnormal SharePoint or OneDrive enumeration.
• Look for newly created application credentials, unexpected Global Administrator assignments, and changes to service-principal owners.
• Correlate suspicious Graph activity with impossible-travel or unusual tenant-to-tenant access patterns.
• Treat the IP address as a lead, not a complete attribution signal; Microsoft cloud traffic can include shared or private infrastructure ranges.

Containment and remediation checklist

🔴 Immediate containment (0–24 hours)

1. Disable the ConnectWise Cloud Backup/SkyKick enterprise application in every affected tenant.
2. Disable or isolate the ConnectWise Cloud Management - MS Teams application until its role assignments are verified.
3. Preserve Entra sign-in and audit logs before disabling access if your legal or incident-response process requires the evidence.
4. Revoke active sessions and tokens associated with the affected applications where supported by your tenant tooling.
5. Review and remove unexpected application credentials, owners, directory roles, and consent grants.
6. Search for mailbox forwarding rules, OAuth grants, suspicious downloads, and new accounts created after October 13.
7. Rotate secrets that may have been exposed through mailboxes, SharePoint, OneDrive, Teams, or directory data.
8. Notify the affected MSP or customer owners and open a case with ConnectWise using its current incident channel.

🟠 Hardening (24–72 hours)

1. Re-authorize only the minimum application permissions required for backup after ConnectWise confirms remediation.
2. Require approval workflows for high-impact enterprise application consent and directory roles.
3. Alert on service-principal sign-ins from new countries, hosting providers, or unexpected IP ranges.
4. Restrict who can add credentials or owners to enterprise applications.
5. Review cross-tenant access settings and MSP delegated administration paths.
6. Confirm that backup jobs, retention, and restore points remain intact after the service interruption.
7. Update incident-response runbooks to include vendor identity compromise and cloud service-principal containment.

🟡 Longer-term controls (1–4 weeks)

1. Build an inventory of every third-party application with access to mail, files, Teams, and directory data.
2. Periodically recertify application consent, permissions, owners, credentials, and last-use timestamps.
3. Separate backup administration from general tenant administration and use dedicated, monitored identities.
4. Centralize Microsoft Graph audit telemetry and retain it long enough for vendor-incident investigations.
5. Test restore procedures independently of the backup vendor’s control plane.
6. Add third-party identity compromise to supplier-risk and business-continuity assessments.

Strategic analysis: the trusted application is now the attack surface

The incident demonstrates why identity and access management must include non-human identities, service principals, and vendor-operated credentials. A customer can enforce phishing-resistant MFA for every employee and still inherit risk from a trusted application whose secret is held outside the tenant.

Cloud backup products are especially sensitive because their business purpose requires broad access to data. That creates a high-value blast radius: compromise of one vendor credential can translate into authenticated activity across many organizations without exploiting an internet-facing server in each environment.

The practical lesson is not to remove every SaaS integration. It is to make consent measurable and revocable, monitor service-principal behavior as closely as user behavior, and maintain a tested path to disable a vendor application without losing the ability to recover critical data.

References

1. GBHackers — Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365 Tenants
2. Huntress — ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
3. The Hacker News — Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
4. Coalition — ConnectWise Investigating Unauthorized Access to Cloud Backup App
5. ConnectWise — Acquisition of SkyKick and Axcient