ConnectWise breach: Cloud services disruption continues three days after initial intrusion detected

ConnectWise has entered day three of disruption to its cloud services, which it had to take offline following a breach of its systems detected on 16 October.

ConnectWise Cloud Backup – formerly SkyKick – offers backup and recovery services to MSPs to protect their customers’ Google Workspace and Microsoft 365 environments.

The company announced it had discovered “recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment”. The firm said its incident response procedures were “promptly initiated” and containment measures put in place.

A little under 12 hours after publishing the initial advisory, at 5.00am UTC on 17 October, the company shut off Cloud Backup access as a “protective measure”. Approximately eight hours later, CloudWise SaaS Security and Cloud Management were taken offline as well “as an additional precaution”.

Customer Microsoft 365 environments accessed

According to security organizations like Huntress and Todyl, which monitor ConnectWise tenant environments on behalf of their customers, the attack started with the application’s identity signing into Microsoft 365 tenants from a hosting provider and receiving Microsoft Graph access tokens.

“This is not how the app normally behaves,” Huntress explained in a blog. “Legitimate traffic comes from Azure private IP space. As of [7.00pm UTC] on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants.”

Expanding on the nature of the threat, Todyl said: “Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.”

According to Huntress’s observations, in the two tenants it has been monitoring that have been compromised, the behaviour after access had been established was “fast, scripted, and notably indiscriminate”.

“The procedure was the same each time: the application granted itself Global Administrator, then planted a new secret on a small number of other applications in the tenant to keep a foothold,” Huntress said, though there were some differences in where the secret was planted.

The incident isn’t over

The issue for ConnectWise MSP customers, as security firm CoreView pointed out, is while it has disabled new logins to its applications, “this should not be read as if the incident is over for businesses that had the affected service principals in their tenant".

Indeed, ConnectWise said in its own advisory that disabling the affected connections only prevents new connections.

“It does not reverse changes previously made inside a tenant,” ConnectWise said.

The company added that while its investigations have established that “existing backup archives remain encrypted, isolated, and preserved,” these findings don’t extend to live Microsoft 365 environments.

As of 19 October, Huntress has discovered “almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity (144.172.64[.]128). Over 300 of these succeeded”.

What should MSPs do now?

ConnectWise has said partners should review their own Microsoft 365 tenants, as well as each managed customer tenant. This includes environments with dormant SkyKick connections.

The company has offered detailed instructions on what MSPs should do now, including:

• Verifying local status and preserving evidence
• Reviewing sign-ins across identities from 13 October minimum – possibly as far back as 1 October – to date. Filter for the IP address listed by Huntress as well as 144.172.64[.]99 and 144.172.64[.]60
• Reviewing directory audit events
• Checking credentials and federation trusts
• Checking roles, application owners, and consent
• Checking policy changes
• Checking exchange and resource activity
• Reviewing remaining connections and recording the outcome.

Further information can be found on the ConnectWise advisory page under the entry listed as Update: Sunday, October 18, 2026 at 01:00 UTC.

Huntress added additional actions impacted customers should take, including:

• Disabling ConnectWise Cloud Backup and ConnectWise Cloud Management - MS Teams in their Microsoft 365 tenant
• Consider also temporarily disabling other ConnectWise Cloud Management application IDs
• Don’t delete the application IDs, only disable them
• Don’t re-enable affected applications until ConnectWise confirms all credentials have been reset.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.