Skip to content
Cyber Security

ConnectWise Cloud Backup (SkyKick) breach: what to check in M365

A stolen ConnectWise Cloud Backup (SkyKick) credential was used to sign in to Microsoft 365 tenants. How it worked, what to disable and what to check.

Geidi Security Operations Team6 min read

In brief

What it is
Attackers used a stolen ConnectWise Cloud Backup (formerly SkyKick) app credential to sign in to Microsoft 365 tenants as the backup app, with no password or MFA involved.
Who it affects
Any organisation whose Microsoft 365 tenant has the ConnectWise Cloud Backup, Cloud Management or older SkyKick apps installed, including through an IT provider.
What to do
Disable, don't delete, the ConnectWise and SkyKick enterprise apps, then review sign-ins, new app credentials and role changes since 13 October 2026.
On this page
  1. How it worked
  2. Are you affected?
  3. What to do now
  4. If you think it already happened
  5. Where Geidi fits
  6. Sources

If your Microsoft 365 is backed up by ConnectWise Cloud Backup, the product that used to be called SkyKick, your backups have been switched off since 17 October 2026, and someone may have been inside your tenant before that.

On 15 October an attacker used a stolen credential belonging to the backup app itself to sign in to customer tenants. Huntress, which spotted the activity, had confirmed unauthorised sign-ins in 162 Microsoft 365 tenants by the evening of 16 October (UTC). ConnectWise has since disabled the apps, suspended the service and reset its credentials, but it says plainly that disabling its apps does not undo anything already changed inside a tenant. That part is on each customer and their IT provider.

This is worth an hour of someone's time this week even if you see nothing wrong. You may not know you have the app at all: backup is often set up by a managed service provider, and SkyKick was sold mainly through them.

How it worked

A backup service needs to read every mailbox, OneDrive, SharePoint site and Teams chat, and to write them back when you restore. So when you connect one to Microsoft 365, an administrator approves an app with tenant-wide permissions. The app then signs in as itself, with its own credential, at any hour. No person is involved, which is the point.

That same design is what made this bad. The attacker didn't phish anyone or guess a password. They held the app's credential, so they signed in the way the backup service does and received tokens with whatever permissions the app already had in each tenant. Multi-factor authentication never came into it, because there was no user to prompt.

Huntress saw the sign-ins come from one address, 144.172.64.128, between 06:13 and 08:34 UTC on 15 October, which is 2.13 to 4.34 in the afternoon in Perth. The attacker moved through tenants a few seconds apart, in order, which points to a script working through a list.

In the one tenant whose audit log Huntress reviewed in detail, it saw no mail or file access. In another, a second ConnectWise app, Cloud Management for Microsoft Teams, was used to give itself the Global Administrator role and then add new credentials to two other apps. That is the move to worry about: a credential added to an app inside your tenant is a back door that survives ConnectWise fixing its own systems. Huntress also points out that directory reads through Microsoft Graph leave no audit trail, so "nothing visible was taken" is as far as anyone can go.

Huntress later reported a second, unsuccessful wave on 15 October against tenants in the policy, national security, trade and critical minerals sectors, most of which didn't use ConnectWise at all. It failed there because the app wasn't installed.

Are you affected?

You are in scope if any of these enterprise applications exist in your Microsoft Entra ID tenant. ConnectWise disabled all seven on its side at 07:00 UTC on 17 October:

  • ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
  • ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
  • Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
  • Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
  • Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
  • Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
  • Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb

In older tenants the Cloud Management apps can appear as "SkyKick Cloud Manager". Search Enterprise applications for both "ConnectWise" and "SkyKick".

Having the app installed doesn't mean you were accessed. It means you need to look.

What to do now

  1. Disable the apps, don't delete them. In the Microsoft Entra admin center, open Enterprise applications, find each app above, open Properties and set "Enabled for users to sign-in" to No. Do this in your own tenant even though ConnectWise has acted on its side: the vendor's switch and your tenant's setting are separate controls. Deleting the app removes its consent, and you'll have to approve it again when the service returns.
  2. Check sign-ins from 13 October onwards. In the sign-in logs, look at service principal sign-ins as well as user sign-ins. Filter by the IP address 144.172.64.128 and by each application ID. ConnectWise lists the user agents Python-urllib/3.12 and python-requests/2.31 with that address. Don't stop at the one IP: look for any sign-in by these apps that doesn't fit the backup schedule.
  3. Check the audit log for changes made by or to these apps. Look for new certificates or client secrets on any application or service principal, new app owners, new permission grants or consents, and directory role assignments, especially Global Administrator and Privileged Authentication Administrator. A secret with a far-off expiry date that nobody remembers adding is a red flag.
  4. Remove anything you didn't authorise, then rotate the credentials of any app that had one added. Disabling the ConnectWise apps does not remove a credential the attacker put on a different app.
  5. Leave the apps disabled until ConnectWise publishes re-enablement steps. As of 21 October 2026 it has given no restoration date. It says existing backup archives remain encrypted and preserved with no sign of compromise, but scheduled backups, restores, SaaS Security alerting and Cloud Management are all unavailable.

While the service is down, nothing new is being backed up, so hold off on large deletions or mailbox clean-ups until it's back. If this has made you rethink your backup arrangements, our piece on backups that survive ransomware covers what to look for.

If you think it already happened

If you find a sign-in from the attacker's address, a role your team didn't assign, or a credential nobody recognises, treat it as an incident rather than a clean-up job. Keep the logs, export them before they age out, and get help from someone who does incident response.

Report it through ReportCyber at cyber.gov.au (opens in a new tab) or call 1300 CYBER1 (1300 292 371). If personal information in mail or files may have been accessed, you may have obligations under the Notifiable Data Breaches scheme. Our guide to notifiable data breaches for small business explains when they apply.

Where Geidi fits

Our cyber security service includes a 24/7 security operations centre, and our team can work through these checks across your Microsoft 365 tenant with you. If you're not sure whether the apps are in your tenant, or what you're looking at in the logs, get in touch.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049