What Happened
On October 17, ConnectWise confirmed attackers had reached inside its Cloud Backup environment, the service that carried the SkyKick name before ConnectWise acquired it and that some older tenants still list under that original brand. The company said it had identified unauthorized access to application identities, the service principals that let Cloud Backup read and write data inside customer Microsoft 365 tenants. Administrators first flagged unusual client activity that Friday, and within days three independent security firms, Microsoft, Huntress, and Todyl, were tracking the same campaign from different vantage points, each piecing together a different slice of the same intrusion.
Microsoft's own telemetry placed the first unauthorized authentication attempts on October 15, traced to a single IP address. Huntress and Todyl had already spotted scripted sign-ins on October 13 and 14, meaning the intrusion predated public disclosure by several days and ran quietly for close to a week before any customer-facing warning went out. Microsoft Threat Intelligence labeled it an active supply-chain attack and assessed that the attacker was abusing permissions the Cloud Backup application already held, including Directory.ReadWrite.All, instead of exploiting a newly discovered software flaw. That framing matters: there was no patch to apply, because nothing was technically broken.
How the Attack Worked
The mechanics matter for every CIO who outsources backup or management tooling to a third party. Researchers at Todyl found that the attacker authenticated directly as the Cloud Backup application itself, using its own client secret, instead of compromising an employee's login. That distinction let the intrusion skip past multi-factor authentication entirely: there was no user sign-in to challenge, only an automated script presenting valid application credentials straight to Microsoft's identity platform. The sign-ins came through plain command-line tools, curl and Python's requests and urllib libraries, hardly the signature of a sophisticated custom toolkit, which suggests the barrier to pulling this off was lower than most CIOs would assume.
Once inside, the attacker held whatever permissions each customer had already granted the backup app in Microsoft Entra ID, often years earlier and rarely revisited since. In at least one tenant, a related ConnectWise application, Cloud Management for Microsoft Teams, granted itself Global Administrator, the highest privilege tier in the directory. Huntress found persistence in one monitored tenant, where the intruder added new credentials and roles to maintain access well after the initial foothold. The attack required no new vulnerability, only a stolen secret and the kind of broad, stale permissions that accumulate quietly across years of vendor onboarding and are rarely pruned.
The Scale, as Far as Anyone Can Tell
Huntress identified at least 162 compromised tenants inside its own customer base alone, with nearly 50 showing suspicious new role assignments that suggested the attacker was establishing persistence, not just scoping out the environment. Todyl's review of nine intrusions found sign-in activity in every single one of them. Neither the three firms involved nor ConnectWise itself has published a total victim count, and the real number across ConnectWise's full partner base is almost certainly higher than what any single security vendor can see from its own limited vantage point into the broader campaign.
All three investigators converged on the same source IP address, 144.172.64[.]128, which at least confirms a single coordinated campaign rather than scattered opportunistic abuse by unrelated actors. ConnectWise said it has no indicators that Cloud Backup partner backup data itself was compromised, a claim that addresses the content of backups but says nothing about what the attacker did with mailbox, file, and Teams chat access inside each victim's tenant during the intrusion window, which is the part that should worry a CIO far more than the backup archive itself.
ConnectWise's Response
ConnectWise shut down customer access to Cloud Backup at 05:01 UTC on October 17 and disabled application access for partners and clients across the board, with no restoration timeline given at the time of writing. That carries a real operational cost of its own: managed service providers and their clients lost access to a backup tool during an active incident, precisely when having reliable, available backups matters most, and precisely when many of those same customers were trying to verify whether their own data had been touched.
The company's guidance to affected organizations was to check service principal sign-ins inside Entra, filter by the Cloud Backup application ID, and look for unexpected source addresses and newly added credentials or certificates dated since October 13. Microsoft, Huntress, and Todyl all published matching remediation advice, which at least gave IT teams one consistent playbook instead of three conflicting ones to reconcile under pressure. ConnectWise has not said when, or with what changed permission scoping, it plans to restore the service to its partners and their downstream clients.
The Vendor Risk Question Every CIO Now Owns
This is far from the first time an MSP-tooling supply-chain incident has turned a backup or remote-management vendor's own credentials into a skeleton key for hundreds of downstream tenants. The pattern should change how CIOs evaluate any vendor that requires standing Microsoft 365 or Entra permissions, especially a smaller tool acquired and rebranded by a larger platform, since SkyKick's older customers may never have revisited the permission scope ConnectWise inherited along with the product when it folded the brand into its own portfolio.
The practical lesson is that disabling a compromised application does not revoke tokens already issued, and those tokens stay valid on their own expiration schedule regardless of how many user sessions get revoked afterward. Every OAuth grant handed to a backup, RMM, or PSA vendor deserves the same periodic review as a privileged employee account: scoped permissions, a hard expiration, and a named owner who actually checks it on a schedule, instead of a single approval made during onboarding years ago and never revisited since. Boards funding security budgets should ask who owns that review today.
