ConnectWise Suspends Cloud Services in Response to Cyberattack

What it is

ConnectWise shut down Cloud Backup (formerly SkyKick) on 17 October 2026, about 12 hours after it began investigating. It shut down SaaS Security and Cloud Management the next day. Attackers had a compromised credential for ConnectWise's own application identities and used it to reach customers' Microsoft 365 tenants. ConnectWise says backups remain encrypted and it has no evidence they were accessed.

How it works

Huntress says the sign-ins used a client assertion, so the credential sits in ConnectWise's tenant. In its words, nothing a customer did could have produced it. The Cloud Backup identity signed in to 162 tenants on 15 and 16 October.

On 15 October, between 06:13 and 08:34 UTC, the actor obtained Microsoft Graph tokens in customer tenants from 144.172.64[.]128. It moved through tenants in sorted GUID order, a few seconds apart, which suggests a script working from a target list. By 17 October, Huntress had seen that IP in nearly 1,000 Entra tenants, with over 300 successful sign-ins.

The same IP was used on 13 and 14 October for password spraying against four law firm tenants and for scripted sign-in attempts.

In one tenant, the Cloud Management Teams app added itself to Global Administrator on 15 October. It then ran a Python script that added client secrets to an MSP management application and to Huntress's own application. This began about two and a half hours before the first sign-ins from the attacker IP and came from Microsoft's internal cloud network. Huntress has not tied the two phases to one operator.

Huntress is highly confident the Cloud Management Exchange Online, MS Teams and SharePoint Online apps were also abused. ConnectWise has shut all three down.

Preconditions / Affected

A successful sign-in did not always give access. Where a tenant lacked the relevant ConnectWise service principal, the attackers could not get in. Tenants that used Cloud Backup, SaaS Security or Cloud Management are the ones to check.

What to do

• Review each Microsoft 365 tenant for configuration changes and persistence. CoreView's Kasper Lindgaard says this is now the customers' job, since ConnectWise has stopped the attack.
• Look for the signs Huntress describes: sign-ins from 144.172.64[.]128, ConnectWise app identities added to Global Administrator, and new client secrets on other applications, including MSP management and security tooling apps.
• Use the IP list and the guidance for reviewing MSP Microsoft 365 environments that ConnectWise has published. The page links to them but does not reproduce them.
• Plan for the outage: scheduled backups, archive access and restores, SaaS Security monitoring and alerting, and Cloud Management user and license management are all affected.

Caveats

ConnectWise has given no restoration timeline. Lindgaard says more than a third of IT leaders wrongly believe Microsoft automatically backs up their configuration, which makes recovery harder. The page gives no count of confirmed compromised tenants beyond the sign-in figures above.