ConnectWise Cloud Backup Breach Reached Microsoft 365 Environments Through Trusted Applications
What Happened
ConnectWise suspended its Cloud Backup service, formerly known as SkyKick, after identifying unauthorized access to application identities used to connect to customer Microsoft 365 environments.
On October 15, unusual authentication activity involving ConnectWise applications was observed across Microsoft 365 tenants. Huntress later confirmed unauthorized sign-ins affecting at least 162 tenants by the evening of October 16. On October 17, ConnectWise disabled seven associated application identities and revoked certificates used by the affected connections to prevent further authentication.
The investigation remains ongoing. ConnectWise currently reports no evidence that stored Cloud Backup archives were compromised. Existing backup archives remain encrypted and isolated. That finding, however, does not establish whether individual live Microsoft 365 environments experienced unauthorized activity.
Why This Incident Is Different
This was not a conventional compromise of an individual user account.
Cloud Backup relies on application identities with broad access to services including:
Exchange Online;
OneDrive;
SharePoint;
Microsoft Teams;
Microsoft Entra directory data;
other resources required for backup and recovery operations.
Those permissions are necessary for the service to function. They also mean that a compromised application identity can become a privileged path into multiple customer environments. That is the central risk in a supply-chain attack: the trust that allows an integration to operate can also be abused by an attacker.
Disabling the Application Does Not End the Incident
ConnectWise highlights an important limitation.
Disabling the affected connections prevents new authentication through those identities, but does not reverse changes already made inside a customer tenant. Previously issued access tokens may remain valid until they expire or are explicitly invalidated.
Organizations also need to determine whether the attacker:
added new credentials;
modified application permissions;
created additional identities;
assigned administrative roles;
created mailbox forwarding rules;
changed Exchange, Teams or SharePoint configurations;
established another persistence mechanism.
Disabling the compromised integration is therefore only the first step.
How Application Identity Was Abused
Huntress found that a compromised identity associated with ConnectWise Cloud Backup was used to obtain Microsoft Graph tokens across customer environments.
In at least one investigated tenant, another ConnectWise application granted itself the Global Administrator role and subsequently added new credentials to other applications in the same environment. This illustrates an important distinction between account compromise and application compromise.
Traditional monitoring often focuses on unusual human sign-ins. In this type of incident, malicious activity may appear to originate from a trusted application that is normally authorized to communicate with the environment.
Application Identities Need the Same Attention as Administrative Accounts
Organizations typically place significant security controls around user and administrator identities. Applications also have identities, permissions and credentials.
In Microsoft 365, these include service principals and other application identities that can access data without an interactive human login. If such an identity has broad privileges, compromising it can provide access across a significant portion of the environment.
Organizations therefore need visibility into:
which applications have access to Microsoft 365;
what permissions they hold;
why those permissions are required;
when those permissions were last used;
who can modify them;
how unusual application sign-ins are detected;
how application credentials can be revoked during an incident.
Why This Matters for MSP Environments
Cloud Backup is widely used by MSPs (Managed Service Providers) to protect customer Microsoft 365 and Google Workspace data. That creates a natural concentration of access. A single trusted vendor integration may have permissions across many customer environments. For an MSP, application governance is therefore not simply a technical configuration issue.
It becomes part of risk management across the entire customer portfolio.
During an incident, the MSP needs to identify quickly:
which customers use the affected application;
what permissions were granted;
whether unusual authentication occurred;
whether roles or permissions were changed;
whether new credentials were created;
whether post-access activity took place.
What Organizations Should Review
ConnectWise advises partners and customers to review Microsoft Entra application sign-in logs and permission changes.
Practical checks should include:
sign-ins involving affected application identities;
authentication from unusual sources;
service principal modifications;
new or modified credentials;
newly assigned administrative roles;
application permission changes;
suspicious Exchange rules;
unusual activity in SharePoint and Teams;
tokens issued before application disablement;
additional persistence mechanisms.
The activity timeline before the integration was disabled is particularly important.
DIAMATIX Comment
This incident illustrates why trust in a third-party service cannot mean unlimited trust in its identity. Cloud applications often receive significant privileges because those privileges are required for their function. Every privilege, however, also creates a potential attack path.
When such an integration is compromised, the key question is not only:
“Did we disable the application?”
It is also:
“What was that identity able to do while its access was still valid?”
Answering that requires authentication logs, administrative changes and application activity to be investigated as one sequence. In a supply-chain incident, the time between the initial warning and validation across all potentially affected customer environments becomes critical.
Practical Takeaway
The ConnectWise Cloud Backup incident demonstrates a central risk of modern cloud environments:
an application can be both a trusted service and a privileged path into the environment.
Application governance therefore needs the same principles applied to human administrative identities:
least privilege → monitoring → periodic review → rapid access revocation → post-incident investigation.
Disabling a compromised integration closes one access path. Investigation needs to determine whether the attacker already created another.
Review which third-party applications have privileged access to your Microsoft 365 environment and whether you can trace how those privileges are being used.
Sources
ConnectWise Trust Center. Cloud Backup Service Interruption and Investigation Updates, 16–18 October 2026.
Huntress. ConnectWise (SkyKick) Vendor Credentials Abused in Microsoft 365 Attacks, October 2026.
Microsoft. Investigation and guidance related to unauthorized activity involving ConnectWise Cloud Backup.
BleepingComputer. Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack, 17 October 2026.
