ConnectWise has suspended its Cloud Backup service (formerly SkyKick) following a security incident that allowed unauthorized actors to reach 173 Microsoft 365 customer tenants. The suspension, which took effect on October 17, 2026, was implemented to contain the incident, which bypassed traditional security layers like Multi-Factor Authentication (MFA).
Security researchers at Huntress confirmed that attackers were able to leverage compromised application-level credentials to gain access to partner and customer environments without triggering MFA or Conditional Access policies. This activity involved unauthorized sign-ins in 173 tenants, primarily originating from the IP address 144.172.64.128.
The Mechanics of the MFA Bypass
The primary danger of this attack lies in the abuse of compromised application-level credentials. Because these identities are used by applications to perform automated tasks, such as cloud backups, the unauthorized authentication bypassed MFA and Conditional Access.
According to analysis from Huntress, attackers used the compromised application to obtain Microsoft Graph tokens. These tokens provide extensive permissions within a tenant, potentially granting the ability to read mailboxes, OneDrive files, SharePoint sites, and Microsoft Teams data. While ConnectWise stated in a trust advisory that there is currently no evidence showing encrypted partner backup archives were accessed, the acquisition of Graph tokens suggests that tenant data was within the attackers’ reach.
Detection and Indicators of Compromise
Administrators of affected tenants are advised to audit their logs for specific technical markers. The malicious activity has been primarily traced to the IP address 144.172.64.128.
Security teams should look for the following indicators in their environment logs:
- Source IP Address: 144.172.64.128
- Targeted Service: ConnectWise Cloud Backup
Methodologies involving automated access to the Microsoft Graph API allow for rapid data access across multiple tenants simultaneously once necessary tokens have been secured.
Mitigation and Tenant Hardening
Since the Cloud Backup service was suspended by ConnectWise on October 17, 2026, the immediate path for the exploit has been closed. However, organizations using the service are encouraged to review the activity within their environments and monitor for any persistent access.
While the service suspension ensures no further unauthorized access via the Cloud Backup application, it also means that automated backups are currently offline. Administrators should verify the status of their data protection strategies and monitor for any persistent access tokens that may have been generated prior to the service suspension on October 17.
