ConnectWise has confirmed unauthorised access to application identities within its Cloud Backup (formerly SkyKick) environment.
As a precaution, ConnectWise is shutting off Cloud Backup application access, temporarily interrupting backup services while its investigation and remediation continue.
ConnectWise states that it has not identified indicators of compromise affecting stored partner backup data and that existing backup archives remain intact.
ConnectWise has also published guidance for checking Microsoft Entra service principal sign-in logs, including the application ID and suspicious IP address associated with the incident.
Organisations using ConnectWise Cloud Backup should review the official advisory for the latest service status, investigation findings and recommended actions.
View ConnectWise's Official Security Advisory
Overe is continuing its own investigation across monitored Microsoft 365 environments and will update this bulletin as further findings become available.
Security researchers have confirmed unauthorised access to Microsoft 365 environments through compromised credentials belonging to ConnectWise Cloud Backup (formerly SkyKick).
As of 17 October 2026, Huntress has reported unauthorised sign-ins across 173 customer and partner tenants.
In a separate observed case, attackers abused the ConnectWise Cloud Management application to gain Global Administrator privileges and add new credentials to other trusted applications.
This is particularly concerning because these applications already have permission to access Microsoft 365 resources.
Third-party backup and management applications often hold extensive permissions across Microsoft 365.
If their credentials are compromised, attackers may be able to inherit these permissions without compromising an individual user's password.
Depending on the permissions granted, that access could include:
Traditional user sign-in monitoring alone may not detect this type of attack.
Attackers may also establish persistence by adding credentials to other applications, meaning disabling the original application does not necessarily remove their access.
In Microsoft Entra ID, navigate to Enterprise applications and search for ConnectWise or SkyKick.
Key application IDs:
ConnectWise Cloud Backup
506e08f9-6e9a-4da4-942b-a099a03644ae
ConnectWise Cloud Management - MS Teams
24205314-2b89-4e07-a2a4-579e898a5640
Review other ConnectWise Cloud Management applications as well.
Follow the latest ConnectWise guidance Updated:
As a protective measure for our Cloud Backup partners and their clients, we are shutting off Cloud Backup application access. This will interrupt backup services for customers until further notice.
As an extra precaution, disable affected service principals, rather than deleting them, until Connectwise confirms credentials have been reset.
Be aware that disabling these applications may interrupt backup and management operations.
In Microsoft Entra ID, navigate to Monitoring → Sign-in logs → Service principal sign-ins.
Review activity associated with the affected application IDs.
A reported suspicious source IP is:
144.172.64.128
This IP was associated with unauthorised activity on 15 October 2026.
The absence of this indicator does not rule out other unauthorised access.
Review Microsoft Entra audit logs for suspicious activity since 13 October, including:
Any unexplained changes should be investigated immediately.
Our security team is proactively investigating the incident across Microsoft 365 environments monitored by Overe.
We're reviewing known indicators of compromise, third-party application exposure and available Microsoft 365 audit activity.
We'll continue examining new findings as the investigation develops and contact customers directly where we identify activity requiring further attention.
Overe provides visibility into Microsoft 365 application configurations, permissions and security activity, helping MSPs identify potential exposure across their managed environments.
The scope of available telemetry can vary by tenant, so a lack of alerts should not be interpreted as confirmation that an environment is unaffected.
If you're concerned about your Microsoft 365 environment or would like assistance reviewing your exposure, please contact the Overe team.
