ConnectWise has suspended customer and partner access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, after attackers compromised application identities and accessed Microsoft 365 tenants.
The incident came to light last week after administrators reported unauthorized access to customer data. Cybersecurity firm Huntress confirmed at least 162 compromised tenants in its environment; Microsoft also detected malicious authentication attempts linked to the service.
Researchers traced the activity to the IP address 144.172.64[.]128. Huntress identified the legitimate Cloud Backup application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and found automated sign-in attempts using tools such as curl/7.88.1, python-urllib/3.12, and python-requests.
According to security researchers, the attackers abused existing application credentials and permissions in Microsoft Entra ID to authenticate directly to customer tenants. The application identities, known as service principals, allow software to access Microsoft 365 resources without an interactive user login. As a result, multi-factor authentication (MFA) would not necessarily block the activity.
The granted permissions potentially allowed attackers to access emails, attachments, OneDrive and SharePoint files, and Microsoft Teams data. Researchers also observed attempts to escalate privileges by assigning administrative roles and adding application credentials. Microsoft described the incident as an active supply-chain attack.
ConnectWise said it had disabled application access while investigating and working on remediation. The company said that it had found no evidence so far that Cloud Backup partner backup data had been compromised. Existing backup archives remain unaffected by the service interruption and are expected to become accessible again once services are restored.
Administrators are advised to review Microsoft Entra service principal sign-in logs, filter for the identified application ID, and investigate unusual source IP addresses. They should also check for unauthorized application credentials, OAuth grants, directory role assignments, and Microsoft Graph API activity. Huntress recommends disabling affected ConnectWise applications and reviewing related integrations, including older applications listed under “SkyKick Cloud Manager.”