ConnectWise Cloud Backup starts coming back Monday. Check your Microsoft 365 tenants before you reconnect

By George Bailey   Published: 10/26/26   5 min read
Cyber News

ConnectWise says it will begin bringing Cloud Backup, the service formerly called SkyKick, back to partners on Monday, October 26. Restores from existing backups come first, then a phased re-enrollment. The service has been off since October 17, after someone used its own Microsoft 365 credential to sign in to customer tenants.

Getting the backups back is good news. Reconnecting the app to a tenant that still holds an attacker’s planted secret would not be. ConnectWise’s own guidance says each Microsoft 365 tenant needs its own review first.

ConnectWise Cloud Backup starts coming back Monday. A tenant that still carries an attacker’s planted app secret should not be the first one you reconnect.

ConnectWise plans to start restoring Cloud Backup on Monday

In its October 25 update, ConnectWise said restoration, testing and security validation are continuing, with “phased partner onboarding targeted for Monday, October 26.” It expects to enable restores from existing backups first and says archives remain encrypted, isolated and preserved, with no sign of compromise. Partners are told to keep the affected app connections disabled until ConnectWise sends instructions that apply to their service.

The incident began on October 15. Huntress found the Cloud Backup app identity signing in to customer tenants from 144.172.64.128, a hosting provider address, and getting Microsoft Graph tokens. Huntress confirmed unauthorized sign-ins in 162 tenants by October 16 and saw sign-in activity from that address in almost 1,000 Entra tenants, more than 300 of them successful.

On October 21 ConnectWise said that, based on evidence including threat intelligence from Microsoft, a China state-aligned group appears to have run the attack, using an openly available agentic AI framework to speed it up.

MSPs and the Microsoft 365 tenants they back up

The backup app holds broad read and write access to mail, OneDrive, SharePoint, Teams and directory data in every tenant where it is consented. Kudelski Security notes it carries permissions such as Directory.ReadWrite.All. In one tenant Huntress reviewed, the related ConnectWise Cloud Management app for Microsoft Teams made itself a Global Administrator and added new client secrets, valid to 2028, to two other applications.

Disabling or reconnecting the ConnectWise apps does nothing to those planted secrets. Kudelski also warns that Microsoft Graph directory reads may leave no audit record, so a quiet log is not proof that nobody looked. MSPs face the wider version of the problem: a management app with a planted secret can reach every customer it is consented into.

Clear each tenant before you turn the SkyKick apps back on

Forward this

For whoever runs our Microsoft 365 or manages it for us: ConnectWise is bringing its Cloud Backup service (formerly SkyKick) back starting Monday after attackers abused its access to customer tenants. Before we reconnect it, can we confirm our tenant was reviewed for extra app secrets, admin roles and mail rules added since October 13, and save the logs before they expire?

Details

Hunt / verify

Source: ConnectWise Trust Center advisory, updated October 25; ConnectWise technical investigation guide

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].