ConnectWise Cloud Backup (SkyKick) Credential Used to Sign In to Microsoft 365 Tenants: Verified Timeline and Open Questions

Updated October 21, 2026, 1:20 PM Central. Cloud Backup, SaaS Security and Cloud Management remain suspended with no restoration date. ConnectWise says it completed a full reset of all accounts and credentials in the Cloud Backup environment on October 19 and is preparing a phased restoration expected to take several days once it begins. It still has not disclosed when the activity began, how the credential was obtained, or which forensic firm is investigating.

ConnectWise Cloud Backup, the Microsoft 365 backup product ConnectWise acquired with SkyKick in 2024, authenticates to customer tenants as a multitenant Entra ID application with tenant-wide permissions. On October 15, 2026, that application's credential was used from 144.172.64.128, an address announced by AS14956 (RouterHosting LLC), to obtain Microsoft Graph tokens in customer tenants in sorted tenant-ID order. Huntress confirmed unauthorized sign-ins in 162 tenants as of 19:00 UTC on October 16 and 173 by 00:18 UTC on October 17, and later reported almost 1,000 tenants with sign-in activity from the address, more than 300 of them successful. After reviewing more than 10,000 tenants with ConnectWise applications, Huntress has found two with hands-on activity after sign-in. Microsoft Threat Intelligence called it an active supply chain attack. ConnectWise said on October 17 that it "cannot determine through our investigation alone whether a particular customer's Microsoft 365 environment experienced unauthorized activity."

Cloudskope's analysis for organizations whose Microsoft 365 is run by an MSP: One Stolen Key. 300+ Companies' Email. ConnectWise 'Cannot Determine' Whose.

Backup products for Microsoft 365 use application permissions: a tenant administrator consents once, and the vendor's application can then obtain app-only tokens for that tenant with a credential the vendor holds. Todyl describes the consent as granting tenant-wide read/write access to mail and attachments, OneDrive and SharePoint files and Teams chats. ConnectWise says the credential used for Cloud Backup was shared across all customers.

What is known

• An application credential for ConnectWise Cloud Backup (app ID 506e08f9-6e9a-4da4-942b-a099a03644ae) was used from 144.172.64.128 on October 15 between 06:13 and 08:47 UTC (Huntress and Todyl windows combined).
• Sign-ins hit tenants in ascending tenant-GUID order. Conditional Access did not apply; the credential type logged was clientAssertion.
• Todyl found nine target tenants that had no active backup subscription. Huntress: "Any organization with the app installed" is affected.
• From 01:58 UTC October 15, ConnectWise Cloud Management service principals assigned themselves directory roles (mostly Exchange Administrator) in about 50 Huntress-monitored tenants. In one tenant the Cloud Management MS Teams app made itself Global Administrator and a Python script added client secrets, expiring 2028, to an MSP management app and to Huntress's own app. Huntress has not tied this phase to the same operator.
• A second, unsuccessful wave on October 15 targeted 16 Huntress tenants in the policy, national security, trade and critical mineral sectors, most of which do not use ConnectWise.
• ConnectWise revoked the shared credentials, disabled seven application identities at 07:00 UTC October 17, suspended Cloud Backup, and on October 18 took SaaS Security and Cloud Management offline.
• No primary researcher has confirmed data exfiltration. Huntress notes Graph directory reads leave no audit trail.

What is unknown

• When unauthorized use of the credential began, and how it was obtained
• Whether the credential was a client secret, a certificate, or both
• How many tenants, partners and end customers consented to the seven applications
• Whether any mail, file or chat was read in any tenant
• Whether the Cloud Management role self-assignments were ConnectWise automation
• The identity of the actor and of ConnectWise's incident response firm
• Whether law enforcement or regulators have been notified
• When service will be restored, and whether each customer will get its own credential

Confirmed by Cloudskope observation (October 18, 2026, 1:56 to 2:16 AM Central)

• ConnectWise status page carries four updates (Oct 16 17:48 UTC; Oct 17 05:11 UTC; Oct 17 17:04 UTC; Oct 18 01:24 UTC). BleepingComputer's 05:01 UTC shutdown time differs from the status page's 05:11 UTC.
• 144.172.64.128 sits in an ARIN range registered to FranTech Solutions, Cheyenne, Wyoming; its /24 has been announced by AS14956 (RouterHosting LLC) since March 8, 2026.
• The publisher tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7 resolves on Microsoft's public metadata endpoint.
• No Item 1.05 8-K filed October 14 to 18, and no EDGAR filing mentions ConnectWise since October 13.
• Microsoft documentation: Conditional Access for workload identities does not cover multitenant third-party apps; Entra ID Free keeps sign-in logs seven days.

Indicators (published by ConnectWise, Huntress, Todyl and Microsoft)

• IP 144.172.64[.]128; user agents Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2, curl/7.88.1
• App IDs: Cloud Backup 506e08f9-6e9a-4da4-942b-a099a03644ae; Cloud Management 2399d300-6fca-4e6a-a686-399fefe75b83; MS Teams 24205314-2b89-4e07-a2a4-579e898a5640; Exchange Online b78f6a77-d4e5-46fb-87e5-d1648bd02519; MS Graph 0de14c77-b9b0-4137-9360-34878a929827; Partner Center 412dcf96-176d-4b3a-a1b0-4981ad66971e; SharePoint Online b2b55f5b-7758-4719-8d8f-88ae172e6bdb. Older tenants may show SkyKick names.
• MITRE ATT&CK: T1199, T1078.004, T1098.001, T1098.003, T1110.003