ConnectWise says it found unauthorised access to application identities in its Cloud Backup environment (the Microsoft 365 and Google Workspace backup service for MSPs, formerly SkyKick). Its Trust Center advisory, first posted 16 October 2026 and updated 17 October 05:01 UTC, says it has shut off Cloud Backup application access as a protective step, which interrupts backups until further notice; it has no indication so far that partner backup data was compromised and the existing backup archive is not affected. Huntress, which found the activity, says the app's Microsoft 365 credential (API secret) is in an attacker's hands: on 15 October between 06:13 and 08:34 UTC it was used from 144.172.64[.]128, a hosting-provider address, to obtain Microsoft Graph tokens in customer tenants, moving through tenants in sorted order a few seconds apart, which points to a script. As of 19:00 UTC on 16 October Huntress had confirmed unauthorised sign-ins in 162 tenants, and says the credential works in every tenant where the app is consented, so any organisation with it installed is exposed. The app's consent covers mail and attachments, OneDrive and SharePoint files, Teams chats and directory data, and some directory reads leave no audit trail. Huntress also saw the same IP password-spraying four law-firm tenants on 13 and 14 October, and in one tenant a ConnectWise Cloud Management app for Teams added itself to Global Administrator and added new secrets to an MSP management app and Huntress's own app; it has not tied that earlier activity to the same operator. Todyl separately reported the same Graph sign-ins and notes that revoking user sessions does not end app access. No country breakdown has been published. Primary: ConnectWise Trust Center advisory; research: Huntress (16 Oct); wire: The Hacker News (18 Oct). UPDATE 17 October (ConnectWise, 17:00 UTC): ConnectWise says it suspended the Cloud Backup service by revoking the certificates used for the affected application connections for all users, so the shared credentials previously used for Cloud Backup are no longer valid. It has brought in an outside incident response firm, has not seen successful threat activity in the environments it monitors since the mitigations, and has no evidence that the encrypted backup archives were accessed; archives are preserved but backup and restore remain unavailable until service is restored. ConnectWise says Cloud Backup gives it no visibility into partner and customer tenants, so it cannot tell whether a given Microsoft 365 tenant saw unauthorised activity; partners must check their own. UPDATE 17 October (Huntress, 21:15 UTC): Huntress now counts almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, more than 300 of them successful, although tenants without the app's service principal could not be accessed. It also found a second, targeted wave on 15 October against 16 tenants in the policy, national security, trade and critical-minerals sectors, most of which do not use ConnectWise products; an automated sweep for Graph tokens (09:25 to 12:35 UTC) was followed by what looked like a manual sweep (13:54 to 14:20 UTC) aimed at Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and the Office 365 Management APIs, and failed where the app was not present. The credential added to a Huntress application in one tenant came from private Azure IPv6 space rather than the earlier IP. Huntress has received unverified outside reports of similar, apparently hands-on activity in other tenants. UPDATE 18 October (ConnectWise, 01:00 UTC): ConnectWise says it first identified the issue on 14 October and at 07:00 UTC on 17 October disabled seven of its application identities: ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae) and six ConnectWise Cloud Management apps, the base app (2399d300-6fca-4e6a-a686-399fefe75b83) plus MS Teams (24205314-2b89-4e07-a2a4-579e898a5640), Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519), MS Graph (0de14c77-b9b0-4137-9360-34878a929827), Partner Center (412dcf96-176d-4b3a-a1b0-4981ad66971e) and SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb). It stresses that disabling them stops new sign-ins through those connections but does not undo changes already made inside a tenant, that previously issued access tokens may stay usable until they expire, and that any credentials, roles or consents an attacker added through other identities need separate clean-up. As a further precaution it has taken SaaS Security (monitoring and alerting) and Cloud Management (user and licence management) offline; Cloud Backup stays suspended with no restoration time, scheduled backups are not running and archives cannot be restored, though ConnectWise says they remain encrypted and it has no evidence they were accessed. It has engaged an outside forensics firm and says it has not yet established whether a product vulnerability was involved; how the credential was exposed is still under investigation. Huntress told The Hacker News it last saw malicious sign-ins from the original IP at 08:45 UTC on 15 October, with targeted manual activity until about 14:20 UTC, and has confirmed abuse of the Cloud Management Teams app in one tenant. UPDATE 18 October (ConnectWise, 18:45 UTC; 19 Oct 02:45 Perth): ConnectWise lists two further attacker IP addresses, 144.172.64[.]99 and 144.172.64[.]60, shared through downstream monitoring of partner and customer environments, alongside the original 144.172.64[.]128, and asks partners to include all three when reviewing Microsoft 365 sign-in and audit logs. Its 16:00 UTC update reported no new confirmed findings; Cloud Backup, SaaS Security and Cloud Management stay suspended, archives remain encrypted and isolated with no sign of compromise, and ConnectWise says that finding does not establish whether individual live tenants were affected. iTnews (19 Oct) reports that the rogue secrets added to the MSP management app and Huntress's app in the one tenant were both set to remain valid until 2028, which would have allowed a return after ConnectWise's own credential was cancelled; Huntress says it found and removed the credential on its app on 16 October. UPDATE 19 October (ConnectWise, 13:45 UTC; 21:45 Perth): ConnectWise says it has not seen successful threat activity in the environments it monitors since 17 October 05:00 UTC (1:00 pm Perth), with containment measures still in place. Cloud Backup, SaaS Security and Cloud Management remain suspended, scheduled backups, archive access and restores are still unavailable, and there is no confirmed restoration time; it will publish a timeline and any reconnection instructions once confirmed. It asks partners who serve customers through a reseller, distributor or marketplace to make sure the administrator of each customer tenant receives and acts on its remediation guidance. UPDATE 19 October (Huntress, 1:30 pm ET / 17:30 UTC; 1:30 am Perth 20 Oct): reviewing application sign-ins across more than 10,000 tenants with ConnectWise apps where it can see logs, Huntress says only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-ins. The other circulating addresses in the same provider range (AS14956, RouterHosting) showed only failed user logins or password spraying, which Huntress does not currently link to the app sign-ins: 144.172.64[.]99 (concentrated spray, 10–14 Oct), 144.172.64[.]60 (a few failed logins, 18 Oct) and 144.172.94[.]243 (broad, ongoing spray against many organisations). Huntress has found a second tenant with post-compromise activity. In both tenants the actions ran within two minutes of each other at about 03:45 UTC on 15 October (11:45 am Perth): the ConnectWise application granted itself Global Administrator, then planted new secrets on a few other applications registered in the tenant, apparently chosen at random and often low-privilege ones, to keep a foothold. Huntress found no mailbox or file tampering or user or policy changes in those two tenants, but notes Microsoft Graph directory reads leave no audit record. The last confirmed successful sign-in with the stolen credential was at 08:44 UTC on 15 October (4:44 pm Perth); since then it has seen only failed attempts. UPDATE 19 October (ConnectWise, 18:50 UTC; 2:50 am Perth 20 Oct): containment remains in place with no successful threat activity seen since 17 October 05:00 UTC; ConnectWise says it is monitoring its entire environment and sees no indication of impact beyond Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, all three of which remain suspended with no restoration time yet. It has published a video walkthrough of its Cloud Backup technical investigation and remediation guide, and repeats that affected applications must stay disabled until it issues formal restoration instructions. UPDATE 20 October (ConnectWise, 00:45 UTC; 8:45 am Perth): ConnectWise says it has strengthened administrative-access protections and is resetting accounts and replacing application credentials in the affected environment, with third-party forensics still validating remediation; existing Cloud Backup archives remain encrypted, isolated and preserved with no indication they were compromised, though it stresses this does not show whether live Microsoft 365 tenants were affected, so each tenant still needs review. Services will come back in controlled phases, with partner instructions issued before anything is re-enabled; no restoration time yet, and the next update is due by 13:00 UTC on 20 October (9:00 pm Perth). UPDATE 20 October (ConnectWise, 13:01 UTC and 19:05 UTC; 9:01 pm 20 Oct and 3:05 am 21 Oct Perth): ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on 19 October and is finishing security validation before restoring services in controlled phases, core infrastructure first, with extra review of the most sensitive connections. Once restoration starts it expects it to take several days; it will give a firmer timeline after the first full day of restoration work and will issue instructions before partners need to re-enable connections. Cloud Backup, SaaS Security and Cloud Management stay suspended, so scheduled backups, archive access, restores, SaaS Security alerting and Cloud Management user and licence management are still unavailable. It is still working with outside specialists to find how the access first happened and its full scope, sees no impact on other ConnectWise products, and has started partner technical webinars every two hours from 18:00 UTC on 20 October (2:00 am Perth 21 Oct) walking through Entra ID sign-in and audit logs, app registrations, credentials and permissions, including legacy backup integrations. UPDATE 21 October (ConnectWise status page, 14:35 UTC; 10:35 pm Perth): ConnectWise says it has begun restoring services in controlled phases after remediation and security validation, with each restoration step subject to security review, and expects restoration to take several days; it says service will return in stages and the start of restoration does not mean all capabilities are available. It will publish step-by-step instructions on when and how partners should reconnect affected services, including any reauthorisation and verification steps, and says partners should keep affected application connections disabled until then. Its investigation continues alongside restoration; existing backup archives remain encrypted, isolated and preserved with no indication of compromise, which it says does not establish whether individual partner or customer Microsoft 365 environments were affected, and it sees no indication that other ConnectWise products are impacted. Next update due by 19:00 UTC on 21 October (3:00 am Perth 22 Oct). UPDATE 22 October (ConnectWise status page, 00:52 UTC; 8:52 am Perth): ConnectWise says phased restoration is underway, with each step subject to security validation, and still expects restoration to take several days; partners should keep affected connections disabled until formal instructions apply to their service. It says existing backup archives remain encrypted, isolated and preserved with no indication of compromise, that it has no indication other ConnectWise products, services or offerings are impacted by this incident, and that individual Microsoft 365 tenants still require review for unauthorised changes or persistent access. ConnectWise says that beginning 22 October it will publish updates twice daily. UPDATE 22 October (attribution): In a Trust Center update at 22:00 UTC on 21 October (6:00 am Perth 22 Oct), ConnectWise says that, based on the evidence available to it, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible for the attack on Cloud Backup, and that the group used an openly available agentic AI framework to automate and speed up its operation; ConnectWise says its containment and phased restoration do not remove unauthorised access that may already have been established within individual customer tenants, which require separate review. In a Microsoft Security Blog post (21 Oct, 18:23 UTC; 2:23 am Perth 22 Oct), Microsoft assesses that Storm-0940, a China-state aligned actor active since 2021, was responsible for the ConnectWise supply chain compromise, and says the actor used ARTEX, an agentic AI penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims. Microsoft says that following the unauthorised access Storm-0940 used ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, and that in some environments the agents progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups and privileged roles, which Microsoft warns can remain active as a backdoor. Microsoft also says Storm-0940 infrastructure at 144.172.64.99 ran a cross-tenant password-spray campaign against 327 accounts across eight organisations between 10 and 14 October in which no successful authentication was observed, that the presence of an affected application or a successful sign-in does not necessarily mean customer data was accessed or exfiltrated, and that the activity did not result from a compromise of or vulnerability in Microsoft corporate systems, products or services. UPDATE 23 October (ConnectWise status page, 01:11 UTC; 9:11 am Perth): ConnectWise says service restoration work is progressing and it anticipates completing testing and security validation of the restored environment by the end of this weekend, which, subject to successful completion, will let it begin returning capabilities to partners in phases: first a process for partners who need to restore data from existing backups, which it currently anticipates enabling early next week, then phased full-service re-enrolment with step-by-step instructions. Partners should keep affected application connections disabled until ConnectWise provides instructions that apply to their service. ConnectWise says that starting 23 October it will move to once-daily updates. Updated 23 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says its teams and independent specialists are continuing restoration testing and security validation, which it expects to complete by the end of the weekend; it then anticipates enabling a process for partners to restore data from existing backups early next week, followed by phased re-enrolment supported by step-by-step instructions, video tutorials and webinars. Partners should keep affected application connections disabled until ConnectWise gives instructions for their service; existing backup archives remain encrypted, isolated and preserved with no indication of compromise; and ConnectWise will publish updates once daily at 14:00 UTC. (source: ConnectWise) Updated 24 Oct 2026 (ConnectWise Trust Center, 14:00 UTC; 10:00 pm Perth): ConnectWise says services are being brought back online in a controlled sequence, including rotating certificates across its infrastructure, with restoration, testing and security validation continuing through the weekend and a target of beginning phased partner onboarding on Monday 26 October, subject to the required checks. It anticipates enabling backup restoration for partners on Monday, followed by phased re-enrolment, and says bringing infrastructure online does not mean all partner capabilities are available. Existing backup archives "remain encrypted, isolated and preserved, with no indication of compromise", and it has no indication that other ConnectWise products, services or offerings are impacted. (source: ConnectWise) Correction (24 Oct 2026): an earlier version said The Hacker News reported 173 affected tenants on 17 October; The Hacker News's article is dated 18 October and does not give that figure, so it has been removed. (source: The Hacker News)
- Product
- ConnectWise Cloud Backup (formerly SkyKick Backup) Microsoft 365 app, application ID 506e08f9-6e9a-4da4-942b-a099a03644ae; six ConnectWise Cloud Management apps (base, MS Teams, Exchange Online, MS Graph, Partner Center, SharePoint Online), all disabled by ConnectWise on 17 Oct; ConnectWise SaaS Security and Cloud Management services offline
- Versions
- Cloud service — every Microsoft 365 tenant where the Cloud Backup app is consented
- Exploited in Australia?
- unknown
- Patch to
- In Entra admin centre, find the enterprise app 506e08f9-6e9a-4da4-942b-a099a03644ae (also listed as SkyKick or ConnectWise Cloud Backup) and set 'Enabled for users to sign-in' to No; disable rather than delete, and leave it off until ConnectWise confirms the credential is rotated. Check service-principal sign-in logs (not the default user sign-ins tab) for that app from 144.172.64.128, 144.172.64.99 or 144.172.64.60 (ConnectWise added the last two on 18 Oct) or anything outside Azure ranges, and review mail, file, Teams and directory activity from 13 October. Audit Entra logs for ConnectWise or SkyKick apps adding themselves to directory roles, and review client secrets and certificates added since 13 October on all enterprise apps and app registrations, especially MSP-management and security tools. Turn on Microsoft Graph activity logs. Note issued tokens stay valid up to about 90 minutes after disabling. Huntress (17 Oct) asks all ConnectWise users to audit service-principal sign-ins to the ConnectWise and SkyKick apps from about 01:00 UTC on 15 October to 02:00 UTC on 16 October (about 9:00 am 15 Oct to 10:00 am 16 Oct Perth), including sign-ins from Azure address space, not just the known IP. Backups are offline while the service is suspended, so plan interim protection for critical Microsoft 365 data. ConnectWise (18 Oct) asks partners to check every tenant they manage, including ones with dormant SkyKick connections, for all seven disabled app IDs (match on Application ID, not display name, and record the local Object ID), keep them disabled until it publishes reconnection instructions, export audit and all four sign-in log types before containment, and check for mailbox forwarding, inbox or transport rules and delegated mailbox access. When reviewing secrets added since 13 October, check their expiry dates too: the rogue secrets seen in one tenant were set to last until 2028. If you buy or resell Cloud Backup through a distributor or marketplace, confirm the administrator of every customer tenant has received ConnectWise's investigation and remediation guide (ConnectWise, 19 Oct). Huntress (19 Oct): also block and hunt for 144.172.94.243 (ongoing password spray), and when checking for planted secrets, review every app registered in your tenant, not only the powerful ones, around 03:45 UTC on 15 October. ConnectWise (19 Oct, 18:50 UTC) has added a video walkthrough of its remediation guide; preserve evidence before making changes, and note that completing the steps does not prove a tenant is unaffected. ConnectWise (20 Oct, 19:05 UTC): credentials in the Cloud Backup environment were fully reset on 19 October, but keep the Cloud Backup connections disabled until ConnectWise publishes formal re-enablement instructions, and plan for restoration to take several days once it starts. ConnectWise (21 Oct, 14:35 UTC): phased restoration has begun, but keep affected connections disabled until ConnectWise publishes reconnection instructions for your specific service. Microsoft (Security Blog, 21 Oct): keep affected ConnectWise connections disabled until ConnectWise gives formal restoration instructions and do not delete enterprise applications as a first response; search by application ID, review activity from at least 15 October and, where records allow, service-principal sign-ins back to 1 October; review successful and failed service-principal sign-ins separately and do not limit review to the published IPs. Microsoft also lists 187.15.88.186, 187.15.90.217 and 187.15.89.186 (VPN IPs, relevant for 15 and 16 October) and the user agents Python-urllib/3.12, python-requests/2.31.0, python-requests/2.34.2, curl/7.88.1 and azure-toolkit/1.0 as seen in sign-ins and Graph activity via the ConnectWise apps.
Primary: ConnectWise Trust Center — Cloud Backup (formerly SkyKick) service interruption advisory (16–18 Oct 2026) · Vendor: Huntress — ConnectWise (SkyKick) vendor credentials abused in M365 attacks (16 Oct 2026) · The Hacker News — ConnectWise suspends Cloud Backup after attackers compromise Microsoft 365 tenants (18 Oct 2026) · Microsoft Security Blog — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (21 Oct 2026) · ConnectWise Status — Cloud Backup investigation and restoration update (23 Oct 2026, 01:11 UTC)
breaches cloud identity ai
