ConnectWise Cloud Backup Microsoft 365 Tenant Compromise

In October 2026, ConnectWise identified a significant security incident involving the unauthorized compromise of application identities associated with its Cloud Backup service (formerly SkyKick). Attackers abused these stolen credentials to bypass individual password requirements, requesting access tokens from Microsoft Entra ID to infiltrate downstream customer Microsoft 365 environments. This enabled the threat actors to potentially access sensitive data within Exchange Online, SharePoint, and Microsoft Teams.

The attack progressed in waves, with a second targeted sweep on October 15, 2026, focusing on approximately 16 tenants within the national security, trade, and critical mineral sectors. Technical analysis indicates the actors attempted to establish persistence by adding client secrets to trusted applications and elevating permissions to Global Administrator roles. While ConnectWise has disabled seven key application identities and suspended affected services, remediation requires manual review by affected organizations to remove unauthorized credentials and persistence mechanisms.

This incident highlights the high risk associated with third-party SaaS applications holding extensive permissions. Organizations using ConnectWise Cloud Backup or SaaS Security services should immediately initiate forensic reviews of their Entra ID audit logs, focusing on unauthorized service principal activity and changes to directory roles.