ConnectWise confirmed unauthorized access to application identities for Cloud Backup, formerly SkyKick, and shut the service down. Attackers then signed in to customer Microsoft 365 tenants as those apps. User multi-factor authentication does not stop an app that already holds a secret.
What happened
On 16 October ConnectWise said it had found unauthorized access to application identities in the Cloud Backup environment and cut off application access. Microsoft and Huntress tied the activity to sign-ins on 15 October from 144.172.64.128. Huntress reported at least 162 tenants with confirmed unauthorized access in its own customer set that day.
ConnectWise's advisory, last updated 19 October at 01:15 UTC, says seven application identities were disabled at 07:00 UTC on 17 October and that shared Cloud Backup credentials are no longer valid. Cloud Backup, SaaS Security and Cloud Management remain suspended. Scheduled backups, archive access and restores are unavailable. ConnectWise says stored archives are encrypted and isolated, and that it has no indication those archives were accessed. It also says that does not tell you whether a live tenant was touched.
Disabling the vendor apps stops new sign-ins. It does not undo role changes, new secrets or mailbox rules already made inside a tenant. Tokens issued before the cutoff can keep working until they expire. On 18 October ConnectWise added two more addresses for log review: 144.172.64.99 and 144.172.64.60.
Who is affected
Any Microsoft 365 tenant that ever granted ConnectWise Cloud Backup or the related Cloud Management apps, including old SkyKick connections that nobody uses. The same application IDs appear in every tenant. Match on the ID, not the display name.
- ConnectWise Cloud Backup: 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management: 2399d300-6fca-4e6a-a686-399fefe75b83
- Cloud Management - MS Teams: 24205314-2b89-4e07-a2a4-579e898a5640
- Cloud Management - Exchange Online: b78f6a77-d4e5-46fb-87e5-d1648bd02519
- Cloud Management - MS Graph: 0de14c77-b9b0-4137-9360-34878a929827
- Cloud Management - Partner Center: 412dcf96-176d-4b3a-a1b0-4981ad66971e
- Cloud Management - SharePoint Online: b2b55f5b-7758-4719-8d8f-88ae172e6bdb
What to do now
Disable the seven apps in your own tenant and in every customer tenant, then look for changes the attacker could already have made.
- In Entra, open Enterprise applications, find each application ID above, and set sign-in to No. Do not delete the app first. Keep the configuration as evidence.
- Export service-principal sign-in logs and audit logs from 13 October onward. Filter for 144.172.64.128, 144.172.64.99 and 144.172.64.60, then review any other unexpected source.
- Check directory roles, especially Global Administrator and Exchange Administrator, plus new application secrets, owners and consent grants since 13 October.
- Review mailbox forwarding, inbox rules and transport rules. A clean sign-in search does not prove mail was not copied.
- Do not reconnect Cloud Backup until ConnectWise publishes restoration steps. Note the last good restore point while the service is down.
What this means for South African businesses
Most South African SMEs do not run ConnectWise themselves. The exposure sits with the MSP, or with a previous MSP that left SkyKick consent in the tenant years ago. A dormant enterprise app with mail and file rights is enough. Treat every old backup consent as live until you have checked the application ID.
Source: ConnectWise Trust Center advisory, updated 19 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.