ConnectWise shuts down Cloud Backup after attackers abuse its Microsoft 365 app identities

ConnectWise first reported on October 16 that it was investigating unauthorized access attempts in its Cloud Backup environment, formerly SkyKick. By early October 17 it had confirmed unauthorized access to application identities, the Microsoft Entra service principals Cloud Backup uses to reach partners' Microsoft 365 tenants, and shut the service off, revoking the certificates behind those connections and disabling seven application identities. Scheduled backups are not running and restores are unavailable, though ConnectWise says existing archives remain encrypted and isolated and it has no evidence they were accessed. It has also taken SaaS Security and Cloud Management offline as a precaution and has no restoration time yet.

Huntress, which saw the activity across its customers, has identified almost 1,000 Entra tenants with sign-ins from the attacker's IP address, 144.172.64.128, more than 300 of them successful. On October 15 the attacker used access through the ConnectWise app family to add credentials to a Huntress application and another app in one customer tenant. Huntress also found that the actor abused ConnectWise Cloud Management apps for Exchange Online, Teams and SharePoint Online.

A second, apparently manual wave on October 15 targeted 16 Huntress-protected tenants in the policy, national security, trade and critical-mineral sectors, most of which don't use ConnectWise products, going after Exchange Online, SharePoint, Teams, Azure Resource Manager and Entra. ConnectWise notes that disabling the apps does not undo changes already made inside a tenant: partners should review service principal sign-ins for the affected application IDs and look for credentials, permissions or other access added through separate identities.