ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access

A major security incident has forced ConnectWise to suspend its Cloud Backup, SaaS Security, and Cloud Management services following an attack exploiting compromised credentials associated with the former SkyKick application. Unknown attackers utilized these stolen application identities to gain access to Microsoft 365 tenants belonging to numerous clients managed by Managed Service Providers (MSPs). Cybersecurity firm Huntress confirmed unauthorized activity across at least 162 Microsoft 365 tenants, tracing malicious sign-ins from an external hosting provider IP address during a specific timeframe in mid-October.
The incident has been characterized as a supply chain attack because a single compromise within the vendor's system impacted many downstream customers through the application permissions granted by the MSPs. While ConnectWise disabled several identities and revoked credentials, it warns that past access tokens may remain active and mandates that each organization independently audit its environment for unauthorized roles or backdoors created by the attackers. The severity is compounded by instances where attacker activity appeared to involve escalating privileges within customer accounts using seemingly legitimate application signatures.

ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services after attackers abused access credentials.
Intruders used a compromised credential of the ConnectWise Cloud Backup application (formerly SkyKick).
The company's investigation is ongoing with third-party experts.
Cloud Backup protects data from clients through email, OneDrive, SharePoint, and Teams chats.
Application identity within Microsoft Entra ID allows backup apps to read/write data without human sign-in.
Huntress confirmed unauthorized access to at least 162 Microsoft 365 tenants on October 15 between 06:13 and 08:34 UTC.
The suspicious logins originated from IP address 144.172.64[.]128.
ConnectWise disabled seven application identities and invalidated shared credentials on October 17.
The company stated that access tokens issued before the shutdown may remain usable until expiration.
Huntress noted instances where ConnectWise Cloud Management apps seemed to grant themselves administrator roles in approximately 50 monitored organizations.

<STEELMAN> The strongest narrative supported by the evidence is that this is a complex supply chain compromise rooted in vendor-to-client trust architecture. Attackers leveraged an application identity, which was granted broad permissions across multiple client environments via ConnectWise’s platform to MSPs, turning one point of failure into mass exploitation. Huntress's detailed findings—including activity originating from non-cloud IPs and the unusual automation seen across tenants—provide granular proof of unauthorized access patterns tied to this specific credential exposure.</STEELMAN>
<PATTERN SCAN> The narrative utilizes an Appeal to Authority by presenting technical details provided solely by third-party firms (Huntress) and vendor self-reporting (ConnectWise), positioning these reports as definitive evidence of the breach's scope. Furthermore, the initial description sets up a strong threat premise ("attackers abused access"), which is then subtly diffused through ongoing investigation caveats ("What they took... is still unclear," "mechanism remains under investigation").
Patterns detected: ARC-0102 Appeal to Authority Game, ARC-0003 Ambiguity</PATTERN SCAN>
<ROOT CAUSE> The unstated paradigm driving this event is the inherent friction between necessary operational trust (granting services broad access permissions for automated efficiency) and absolute security isolation. It exposes a structural vulnerability in decentralized cloud service management where the failure of one vendor component immediately risks a vast, disparate user base.</ROOT CAUSE>
<IMPLICATIONS> The primary cost bears by customers is not necessarily data loss yet, but systemic operational risk: the necessity to perform deep, manual forensic review across every single connected account. Those who benefit are potentially sophisticated threat actors capitalizing on established vendor relationships as covert vectors for large-scale persistence. A second-order consequence is a forced acceleration of zero-trust models in MSP environments, moving security policy enforcement further down into individual client boundaries.</IMPLICATIONS>
<BRIDGE QUESTIONS> If the attacker's actions involved application accounts rather than human logins, how should organizations redefine the concept of "access rights" within their identity protocols? What structural changes must be implemented to prevent a single vendor compromise from resulting in cascading, system-wide risk across dozens of distinct customer tenancies?</BRIDGE QUESTIONS>
<COUNTERSTRIKE SCAN> A coordinated influence campaign might leverage this incident by selectively releasing data—focusing solely on the "supply chain" nature while downplaying active attacker persistence or obfuscating the true depth of administrator roles compromised. The current content resists this pattern because it transparently presents multiple uncertainties (what was taken, whether vulnerabilities were involved) alongside highly specific findings.</COUNTERSTRIKE SCAN>