ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]

The backups are coming back. Make sure the attacker’s planted app secrets are gone before the SkyKick apps are.

Universal Cloud provides Microsoft 365 managed security, AI-intelligent unified communications, and compliant IaaS/PaaS solutions. Transform your business with secure, scalable cloud infrastructure.

View post on Reddit.

A stolen credential inside one IT vendor's backup app let a Chinese state-aligned hacking group try to break into more than 2,250 companies in a matter of hours, many of which had no idea ConnectWise was even in their supply chain. Microsoft said on October 21 that it has tied a nation-state group it calls Storm-0940 to a breach of ConnectWise's Cloud Backup service, the tool formerly known as SkyKick that thousands of managed service providers use to back up client email, files and Microsoft Teams data. The attackers stole the app's own credential, the one ConnectWise uses to authenticate to customer Microsoft 365 tenants on its own behalf, and used it to log in as the app itself. No password. No multi-factor prompt. Just a trusted identity that nobody thought to watch. Huntress, the security firm that first caught the activity, confirmed unauthorized sign-ins at 162 tenants by October 16. Microsoft's own numbers, published five days later, are far larger: Storm-0940 attempted sign-ins against more than 2,250 Microsoft 365 tenants, at a rate of roughly 2,900 attempts per minute. Huntress separately found nearly 1,000 tenants that had received sign-in attempts from the attacker's infrastructure, with more than 300 showing...

Nutzer des Cloud Backups von ConnectWise müssen dringend ihre Systeme prüfen, da Angreifer diese möglicherweise bereits kompromittiert haben.

ConnectWise has posted on their status page that they are investigating unauthorized access events in their Cloud Backup platform (formerly SkyKick). While ConnectWise has not confirmed successful unauthorized access, third-party intelligence sources claim that a threat actor gained access and pivoted to live O365 environments of MSP customers using ConnectWise Cloud Backup. The Cloud Backup platform is used by MSPs to back up all of O365, including EntraID, which could result in significant impact if data files were accessed.

TL;DR Threat actors stole a vendor API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 environments. During this ConnectWise Cloud Backup breach, attackers signed in to over 300 Microsoft Entra tenants and planted backdoor credentials in select environments. Consequently, ConnectWise suspended its backup and management services while security teams urge administrators to audit their application secrets immediately.

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.

Storm-0940 used ARTEX AI agents to abuse ConnectWise apps and Okta self-registration. Get the IOCs, detection guidance, and steps to take now.

A compromised ConnectWise Cloud Backup (formerly SkyKick) credential has enabled unauthorised Microsoft 365 access. Researchers have identified service principal sign-ins, privilege escalation and att...

Attackers used ConnectWise Cloud Backup

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.

The service formerly known as SkyKick is down for every partner while ConnectWise revokes certificates. It says archives remain encrypted and isolated, and that it cannot see into partners' Microsoft…

ScalePad incident on October 19, 2026: ConnectWise has currently disabled API access to its Cloud Backup (Skykick) service due to suspected unauthorized access to their infrastruc Started 3:19 PM UTC, resolved ongoing (● 6m). Affected: Backup Radar.

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services.

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.