ConnectWise’s Cloud Backup service, formerly SkyKick, was still unavailable as of 16:00 UTC on October 18, and Huntress has now confirmed unauthorized sign-ins in 173 partner and customer Microsoft 365 tenants. The company first identified unauthorized access on October 15 and published an advisory on October 16, so the outage has run for several days with few details released.
ConnectWise Shuts Down Cloud Backup, SaaS Security and Cloud Management
ConnectWise said it found unauthorized access to application identities in its Cloud Backup environment on October 15, then shut down application access for partners and customers. SaaS Security and Cloud Management, which are integrated with Cloud Backup, were suspended as a precaution. End users currently cannot back up data, reach archives or restore.
ConnectWise says existing archives remain encrypted and isolated, that it has no evidence they were accessed, and that it has no indicators partner backup data was compromised. It declined to discuss attribution. The company published indicators of compromise, disabled integrations with Exchange, Teams, SharePoint Online and its own products, and is conducting forensic analysis and remediation.
How a Stolen Cloud Backup App Secret Bypassed MFA
Huntress said a Microsoft 365 credential, an API secret belonging to the Cloud Backup app, was compromised, and that the credential works against every tenant where the app is consented. Huntress first confirmed 162 affected tenants and later raised the count to 173.
Todyl reported that the attacker authenticated directly as the backup application using its secret, through an automated script. Because no user login was involved, multifactor authentication offered no protection. The app’s existing consent allows read and write access to mail and attachments, OneDrive and SharePoint files, and Teams chats. In nine tenants Todyl analyzed, it found only sign-in activity, with no new accounts or persistence.
Cloud Management Service Principals Granted Themselves Admin Roles
Huntress saw a more aggressive pattern in nearly 50 tenants it monitors. ConnectWise Cloud Management service principals for Exchange Online, Teams and Graph assigned themselves directory roles, mostly Exchange Administrator. In at least one tenant, the “Cloud Management – MS Teams” app gave itself Global Administrator and added new client secrets to an MSP management app and to Huntress’s own app, all in about five minutes.
A Reddit user separately reported a Microsoft Privileged Identity Management alert on October 15 showing a SkyKick service principal assigning itself Exchange Administrator, even though the app had not been used in years.
Microsoft Calls It an Active Supply-Chain Attack
Microsoft confirmed unauthorized authentication attempts from an IP address on October 15 and called the incident an active supply-chain attack. It observed persistence through a backdoor after service-principal authentication, followed by Microsoft Graph reconnaissance. Microsoft assessed that the attacker likely abused permissions the app already held, such as Directory.ReadWrite.All.
All three security firms tied the activity to IP address 144.172.64[.]128. Huntress linked the same address to password spraying against four law-firm tenants on October 13 and 14, with no successful user sign-ins seen. It also observed scripted sign-in attempts using the user agent curl/7.88.1, along with python-urllib/3.12, python-requests/2.31 and python-requests/2.34.2.
Remediation Guidance for MSPs and Their Customers
Disabling the app does not remove credentials the attacker already planted inside tenants, so cleanup is more than switching the integration off. Guidance from Huntress and Microsoft says administrators should:
- Disable the implicated apps until credentials are confirmed reset.
- Enable Microsoft Graph activity logs.
- Audit app credentials and OAuth grants added since October 13.
- Check Entra audit logs for ConnectWise or SkyKick apps adding themselves to directory roles.
Older tenants may list the apps as “SkyKick Cloud Manager.”
Why Managed Service Provider Exposure Extends Beyond ConnectWise Customers
Reporting on the outage noted that end-user organizations may not know their managed service provider uses ConnectWise, which means some affected tenants may not realize they are exposed. It compared the risk to the 2021 Kaseya attack, in which a compromise of a management vendor reached downstream customers.
The pattern here is consistent with that history. A single application secret, valid across every consenting tenant, gave the attacker the same reach as the vendor’s own integration, and MFA could not intervene because the sign-ins came from an application rather than a person. Organizations that rely on backup and management apps with broad Microsoft 365 permissions face the same structural risk, since consent granted years ago can persist long after anyone remembers it.
ConnectWise has not said when the services will return, how the secret was obtained, or whether the attacker is linked to the earlier password-spraying activity beyond the shared IP address.
