ConnectWise Cloud Backup Application Credentials Abused to Access Microsoft 365 Tenants

The Threat

On October 16th, 2026, ConnectWise issued an advisory stating that it was investigating unauthorized access attempts and suspicious authentication activity against the ConnectWise Cloud Backup (formerly SkyKick) environment. Security researchers confirmed that a threat actor had gained access to a compromised Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup and was using it to gain unauthorized access to customers' Microsoft 365 environments.

ConnectWise disabled seven application identities on October 17th, preventing new authentications through the connections. Organizations should review the technical guidance provided by ConnectWise to confirm that the impacted application identities are disabled within their environment, revoking any issued tokens that may still be active, and reviewing for any logins from the identified attacker IP addresses.

What we're doing about it

• eSentire's Threat Response Unit (TRU) is performing threat hunts for known Indicators of Compromise (IoCs) across eSentire MDR for Log customers that collect Microsoft Entra and Microsoft 365 logs
  • Impacted customers will be notified by the eSentire SOC
• TRU is tracking this topic for additional information and detection opportunities

What you should do about it

• Check whether your organization or your MSP uses ConnectWise Cloud Backup, Cloud Management or SkyKick (older tenants may list the Cloud Management apps as "SkyKick Cloud Manager", so match on Application ID)
  • Ensure that the impacted applications are disabled (not deleted) until ConnectWise confirms that all credentials have been reset
  • eSentire does not utilize ConnectWise Cloud Backup
• Preserve available authentication and audit logs
  • Perform an audit of relevant logs to identify any sign ins from the IP addresses identified by ConnectWise
  • Investigate application, user authentication, and activity logs for signs of suspicious or unauthorized actions
• eSentire MDR for Log customers should ensure that Microsoft Entra and Microsoft 365 logs are ingested

Additional information

The impact of this attack depends on the permissions that have been granted to the application within each tenant. As ConnectWise Cloud Backup is a backup service, it would typically have read/write access to emails, files, Microsoft Teams, and directory data. An attacker with valid tokens for this application would inherit the same level of access, allowing for possible data exfiltration or deletion. In one instance, Huntress identified a tenant where the application could assign directory roles, resulting in the attacker adding the application to the Global Administrators role to add credentials to other applications, granting persistence.

Organizations should review the list of impacted applications to confirm if they are in use within their environment and, if so, ensure that they are disabled. Any previously issued token that remains active should be revoked. Impacted applications should be audited to determine roles held, such as Global Administrator or Privileged Authenticated Administrator; any unknown roles should be removed. While the Cloud Backup service is disabled, backup and restoration services will be unavailable. Organizations should also review relevant Microsoft Entra and Microsoft 365 logs for signs of login activity from the identified IP addresses; if any logins are identified, a full audit of activity should be performed to determine impact.

At the time of writing, ConnectWise is continuing to investigate this activity with third-party investigators. Updates regarding the investigation continue to be shared by ConnectWise on their advisories page.

Indicators of Compromise (IoCs) Identified by ConnectWise

Impacted Applications

References

[1] https://www.connectwise.com/company/trust/advisories
[2] https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
[3] https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf