ConnectWise Cloud Backup (SkyKick): one stolen key, 173 Microsoft 365 tenants opened
Your SMB did nothing wrong, and yet someone may have read your email. On October 15, the credential of the ConnectWise Cloud Backup app (formerly SkyKick), a Microsoft 365 backup service widely used by IT providers, was used to sign in to customers’ Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 173 tenants. The key wasn’t stolen from customers but from the vendor, so it opened every door where the app was authorized.
If your IT provider backs up your Microsoft 365 with ConnectWise Cloud Backup or SkyKick, here’s what happened, what to check this week and the questions to ask them.
What happened with ConnectWise Cloud Backup
To back up your email, files and Teams chats, the app is granted broad rights in your tenant. It authenticates with a credential kept in ConnectWise’s own tenant. That credential is what ended up in the wrong hands.
🔑
ConnectWise Cloud Backup app credential
Kept by the vendor, valid in every tenant where the app is authorized
↙ ↓ ↓ ↓ ↘
🏢
Accounting firm
sign-in confirmed
🏢
Clinic
sign-in confirmed
🏢
Manufacturer
to be checked
🏢
Agency
sign-in confirmed
🏢
Your SMB?
to be checked
🏢
Non-profit
to be checked
Illustration: one key, many locks. Huntress confirmed unauthorized sign-ins in 173 tenants; any organization with the app installed is potentially exposed.
At one Huntress partner, the attack went further: a second app, ConnectWise Cloud Management – MS Teams, gave itself the Global Administrator role, then added new credentials to two other apps in the tenant. In other words, extra service doors that stay open even after ConnectWise is disabled.
Timeline: October 14 to 17
Eastern Time (EDT), based on Huntress, ConnectWise and The Hacker News.
Why a backup app has so much power
A full Microsoft 365 backup means being able to read everything. The same rights, in an attacker’s hands, give this:
| Access granted | Normal use by the app | What an attacker can do with it |
|---|---|---|
| 📧 Email (Exchange Online) | Copy every mailbox for backup | Read conversations with your clients, banks and vendors: ideal material for payment fraud |
| 📁 OneDrive and SharePoint | Copy files and libraries | Download contracts, client lists, HR files |
| 💬 Teams | Back up chats and team files | Read internal discussions, find out who approves payments |
| 👥 Directory (users, groups, roles) | Know what to back up and for whom | Map the company, grant itself roles and add hidden access |
Checking ConnectWise Cloud Backup in your Microsoft 365: the annotated console
Here’s a simulation of what an administrator could find in the Microsoft Entra admin center of an affected SMB.
What to look for
- 1The backup app is present: if it doesn’t show up, remove the “Enterprise applications” filter and search again.
- 2An app holding an administrator role nobody gave it: that is exactly what Huntress observed at one partner.
- 3The sneakiest trap: a new secret added to another app. Disabling ConnectWise does not remove it.
The 6 checks to do this week
Find the app
Entra › Enterprise applications › search "506e08f9" or "SkyKick"
Run the same search with “ConnectWise”. If nothing comes up, remove the filters. If it still doesn’t appear, your tenant doesn’t use this service.
Disable it, don’t delete it
App › Properties › Enabled for users to sign-in: No
Huntress and ConnectWise recommend disabling, not deleting: disabling doesn’t affect the backups ConnectWise has already stored. Do the same for the other ConnectWise Cloud Management apps, and don’t re-enable them until ConnectWise confirms every credential has been replaced.
Read the right log
Monitoring › Sign-in logs › Service principal sign-ins
The default tab (user sign-ins) shows nothing. Filter by the app ID and look for any IP address outside Microsoft and Azure ranges, especially 144.172.64[.]128. In the unified audit log, also look for unusual mailbox access, file downloads and directory changes from October 14 to 16. A clean log does not prove nothing was read.
Remove unexpected roles
Entra › Roles and administrators › Global Administrator
No backup app needs to be a Global Administrator. Remove any role you didn’t grant on purpose.
Review secrets and certificates on ALL apps
Entra › App registrations › Certificates & secrets
Look for any secret or certificate added since October 13 that nobody on your side created, especially on management and security tools. Remove it after documenting it (date, app, thumbprint).
Close the backup gap
While Cloud Backup is suspended, scheduled backups aren’t running: email and files created since October 17 aren’t protected anywhere. Plan a temporary copy of key mailboxes and libraries, and have ConnectWise confirm your archives are retained.
Questions to ask your IT provider
These questions apply even if you don’t use ConnectWise: every backup, management or security tool connected to your Microsoft 365 holds a similar key.
- Which third-party apps have rights in our Microsoft 365 tenant, and which ones are no longer used?
- Have you checked the service principal sign-in logs, and what did you find?
- Do our Microsoft 365 backups have a second copy, with a different provider?
- Who gets alerted, and how fast, when an administrator role or an app secret is added?
- Are our vendors’ apps restricted by Conditional Access rules (IP addresses, locations)?
The lesson for every SMB
Third-party apps have become the new way into Microsoft 365. They don’t go through multi-factor authentication, they work at night and nobody reads their logs. Keep an inventory of these apps, remove the ones you no longer use and have role and secret additions monitored. And a single backup, with a single provider, isn’t a strategy: the IDCF Cloud incident already showed that.
Finally, if personal information may have been accessed, Quebec’s Law 25 requires you to assess the risk of serious injury and record the incident in your register of confidentiality incidents.
To go further: our Microsoft 365 services, our backup and disaster recovery offer with an independent copy, our proactive monitoring of your systems, and the decision tree on abused remote access tools.
Book your free cyber check
Not sure which apps have rights in your Microsoft 365, or whether your backups have a second copy? The free cyber check reviews your access, your backups and your administrator accounts, and gives you a clear list of fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks”, October 16, 2026
- Huntress Support, “2026 – October SkyKick” (self-assessment)
- ConnectWise Trust Center, “Cloud Backup (formerly known as SkyKick) Service Interruption” advisory, updated October 18, 2026 (UTC)
- The Hacker News, “Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants”, October 17, 2026
Photo: Brett Sayles, Pexels (Pexels licence).