ConnectWise has suspended its Cloud Backup service and disabled seven application identities after threat actors obtained unauthorized access to identities used to connect with Microsoft 365 tenants. The company said the investigation remains active and that scheduled backups, archive access and restores are unavailable until further notice. ConnectWise’s advisory said the service was shut down as a protective measure, while existing backup archives remain encrypted and preserved. [1]
The incident centers on ConnectWise Cloud Backup, formerly known as SkyKick Cloud Backup, and related Cloud Management integrations. The seven disabled identities include ConnectWise Cloud Backup, with application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, as well as identities for Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, SharePoint Online and the broader ConnectWise Cloud Management service. ConnectWise disabled the identities at 07:00 UTC on October 17, according to its technical guidance. [1]
ConnectWise said it revoked certificates used for affected application connections across all users and invalidated shared Cloud Backup credentials. Those actions prevent new authentication through the affected connections but do not automatically reverse changes already made inside a customer tenant. Previously issued tokens may also remain usable until they expire or are separately invalidated, the company warned. ConnectWise has not provided a restoration time.
The company has not confirmed how many Microsoft 365 tenants were compromised. Security researchers, however, reported unauthorized sign-ins involving the Cloud Backup application across partner and customer environments, with Huntress cited as having observed activity in 173 tenants. The reported activity involved an application identity rather than a conventional user account, creating a supply-chain access path across multiple Microsoft 365 organizations. BleepingComputer reported that administrators were being urged to investigate the application IDs in Microsoft Entra service-principal sign-in logs. [4]
ConnectWise said it had no indication that Cloud Backup archives themselves were accessed, but cautioned that it cannot determine from its own systems whether a particular downstream tenant experienced unauthorized activity. A successful application sign-in also does not by itself prove that data was copied. The company has not attributed the intrusion to a named threat actor, and its advisory assigns no CVE identifier or CVSS score; the mechanism by which the application credentials were exposed remains under investigation. [1]
Microsoft 365 administrators should review their own tenant and any managed customer tenants, including dormant SkyKick connections, rather than relying only on ConnectWise’s shutdown. ConnectWise recommends preserving sign-in and audit records, checking service-principal activity from October 13 onward, investigating the suspicious address 144.172.64.128, and reviewing application credentials, consent grants, role assignments, Conditional Access changes, mailbox forwarding, inbox rules, transport rules and delegated mailbox permissions. Administrators should match enterprise applications by application ID, keep affected connections disabled, preserve evidence rather than deleting them immediately, and assess any gap in backup coverage while scheduled jobs remain suspended. [1]
References
- Trust Center | Advisories | ConnectWise
- Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
