Compromised ConnectWise Cloud Backup identities used to access Microsoft 365 tenants

Threat summary

ConnectWise is investigating a security incident involving unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick.

The company disclosed the incident on October 16, 2026, and has since suspended Cloud Backup, SaaS Security, and Cloud Management services while containment, remediation, and forensic activities continue.

As of October 19, ConnectWise reported that it had not observed successful threat activity in environments it monitors after implementing containment measures, although the investigation remains active.

ConnectWise Cloud Backup integrates directly with Microsoft 365 to perform backup and recovery operations. To do this, customers grant the service permission to access resources such as Exchange Online, SharePoint, OneDrive, Teams, directory data, and Microsoft Graph, the application programming interface (API) used by Microsoft 365 services. Once approved, the application can authenticate directly to Microsoft cloud services and operate with the permissions assigned within each tenant.

Researchers confirmed that a credential used by ConnectWise Cloud Backup was compromised and used to obtain Microsoft Graph access tokens across customer tenants. Microsoft Graph was not compromised. Instead, the threat actor obtained a credential belonging to a trusted application that already had permission to use Microsoft Graph on behalf of customer organizations. Because Microsoft recognized the application as trusted, the threat actor was able to authenticate as the service itself and inherit the permissions already assigned to it.

Microsoft Threat Intelligence assessed that the threat actor abused permissions previously granted to the application, including high-privilege permissions such as Directory.ReadWrite.All. Microsoft observed successful service principal authentication, Microsoft Graph reconnaissance, and attempts to add additional credentials to service principals after access was obtained.

As part of its response, ConnectWise disabled or revoked access associated with seven Cloud Backup and Cloud Management integrations. These applications had been granted access to customer Microsoft 365 environments to perform backup, management, and recovery functions. Researchers later reported activity involving multiple Cloud Management applications in addition to ConnectWise Cloud Backup, indicating that the activity extended beyond a single application.

Researchers also observed activity designed to expand and maintain access after the initial compromise. In one tenant, a ConnectWise Cloud Management - MS Teams application assigned itself the Global Administrator role and added credentials to other trusted applications. Those credentials could then be used independently of the original ConnectWise credential, creating persistence that would survive credential rotation or revocation.

Researchers identified unauthorized sign-ins in more than 160 tenants and later reported broader authentication activity across hundreds of Microsoft 365 environments.

Our response

Field Effect notified affected clients on October 16, 2026, after identifying tenants that had authorized the affected ConnectWise Cloud Backup application.

Access granted to the identified application was revoked where observed, eliminating its ability to authenticate into those environments through the previously approved trust relationship.

Our team has deployed additional detections across Field Effect MDR to identify new consent activity involving the affected ConnectWise application IDs. Any newly identified authorizations or related activity will generate an ARO for further investigation.

Field Effect continues to monitor developments related to the incident and will provide additional guidance as new information becomes available.

If you have questions for our team, please reach out to your rep or contact us here. 

Analysis

This incident highlights the growing security importance of cloud application identities. Defensive controls for endpoints and user accounts are often a primary focus, however cloud platforms increasingly rely on service identities that hold broad permissions across email, file storage, collaboration platforms, directories, and administrative functions. Those identities often operate with a level of access comparable to privileged users.

A threat actor that gains access to one of these trusted identities does not need to bypass authentication controls or compromise individual tenants separately. The trust relationship already exists, meaning threat actors can leverage permissions that were intentionally granted to the application as part of normal business operations.

The level of risk varies between organizations based on the permissions granted to the affected applications. Environments that provided access to email, file storage, collaboration platforms, directory services, or administrative functions may have exposed a larger portion of their Microsoft 365 environment than organizations that granted more limited permissions.

The investigation remains ongoing, and the full scope of downstream activity has not yet been determined. While ConnectWise has disabled the affected application identities, organizations continue to assess whether any unauthorized activity occurred within their Microsoft 365 environments before containment measures were implemented.

For managed service providers, the risk extends beyond a single Microsoft 365 tenant. Backup and management platforms often operate across multiple customer environments. A compromised application with delegated access to numerous tenants can create downstream exposure across customer organizations, making it important to review both internal and customer Microsoft 365 environments for authentication activity, permission changes, and newly created credentials.

Mitigations

Review Microsoft 365 tenants for ConnectWise Cloud Backup, SkyKick, and related ConnectWise Cloud Management applications. Identifying these applications helps determine where trusted access relationships exist and whether affected identities remain present within the environment.

Review Microsoft Entra service principal sign-in activity associated with affected application IDs. Service principal authentication records can help identify whether the compromised applications authenticated into a tenant during the period of observed activity. Review activity associated with published indicators, including the IOCs noted by the vendor.

Investigate application credentials, OAuth consent grants, privileged role assignments, ownership changes, and newly created secrets or certificates. Researchers observed attempts to add credentials and successful credential creation within affected tenants. These reviews help identify persistence mechanisms that may remain active after the original application is disabled.

Review access to Exchange Online, SharePoint, OneDrive, Teams, and Microsoft Entra resources associated with affected applications. Understanding which resources were accessible can help scope potential exposure and prioritize response efforts.

Monitor for unexpected Microsoft Graph activity, service principal sign-ins, application credential changes, and directory role modifications. These activities were observed during the intrusion and may help identify related activity in affected environments.

Follow ConnectWise guidance regarding affected application identities and service restoration activities. This helps ensure revoked identities remain disabled until service recovery actions are complete.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up