⚠️ Urgent threat notice
Description
ConnectWise is investigating unauthorized access attempts involving its Cloud Backup service, formerly SkyKick, which integrates with Microsoft 365 environments. Suspicious authentication activity has been detected, and containment measures are in place. There is no current evidence that partner backup data has been accessed. Organizations using ConnectWise Cloud Backup are advised to review their Microsoft Entra enterprise applications for specific indicators of compromise and consider disabling the affected application temporarily. The investigation is ongoing, and ConnectWise will provide updates as available.
Reddit Discussion
⚠️ We are actively investigating a security incident involving ConnectWise Cloud Backup (formerly SkyKick), following reports of unauthorized access to customer Microsoft 365 environments.
On October 16, 2026, ConnectWise published a security advisory acknowledging suspicious authentication activity associated with its Cloud Backup environment. While ConnectWise has implemented containment measures, independent security researchers have reported confirmed compromise involving the application's access to customer tenants. https://www.connectwise.com/company/trust/advisories
What are we investigating?
APG is continuing to review available indicators of compromise, investigate suspicious authentication activity, and assess potential impacts to affected environments. The presence of the application alone does not confirm unauthorized access or data exfiltration.
What should organizations do?
Organizations using ConnectWise Cloud Backup should review their Microsoft Entra enterprise applications for the following indicators:
Application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae
Associated IP Address: 144.172.64.128
We recommend considering disabling the affected enterprise application while the investigation continues, reviewing historical authentication activity, and monitoring for additional guidance from ConnectWise. Disabling the application may temporarily disrupt associated backup services.
More to follow.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On October 16, 2026, ConnectWise published an advisory regarding suspicious authentication activity linked to its Cloud Backup environment, which may have allowed unauthorized access to customer Microsoft 365 tenants. The company has implemented containment measures and is actively investigating the scope and impact. Independent researchers have confirmed compromise involving the application's access, but ConnectWise reports no indication of partner backup data being accessed. Indicators of compromise include a specific application ID and an IP address. Organizations are recommended to review authentication logs and consider disabling the affected enterprise application while the investigation continues.
Potential Impact
Potential unauthorized access to customer Microsoft 365 environments via the ConnectWise Cloud Backup application could lead to exposure of tenant data or disruption of backup services. However, ConnectWise currently reports no evidence of data access or exfiltration. The presence of the application alone does not confirm compromise. Temporary disabling of the application may disrupt backup operations.
Defensive Guidance
ConnectWise has implemented containment measures and is investigating the incident. Organizations using ConnectWise Cloud Backup should review their Microsoft Entra enterprise applications for the application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and associated IP address 144.172.64.128. It is recommended to consider disabling the affected enterprise application temporarily to prevent unauthorized access, understanding this may disrupt backup services. Organizations should monitor for further guidance from ConnectWise. Patch status is not yet confirmed—check the vendor advisory for updates.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":37,"reasons":["external_link","urgent_news_indicators","established_author","very_recent"],"isNewsworthy":true}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6ad27bfa2cdf04f65628b2e7
Added to database: 10/16/2026, 19:33:14 UTC
Last enriched: 10/16/2026, 19:33:20 UTC
Last updated: 10/16/2026, 20:18:11 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.