In its 1 p.m. EDT update on October 17, ConnectWise said it had revoked certificates used for affected application connections and invalidated shared credentials for ConnectWise Cloud Backup, formerly SkyKick. The company said its encrypted backup archives remained isolated and preserved, but access and restoration were unavailable. ConnectWise also said it had no evidence the archives had been accessed, while its investigation could not determine whether any individual customer’s live Microsoft 365 tenant had unauthorized activity. ConnectWise’s advisory
ConnectWise reported that scheduled backup jobs were not running. New or changed data could therefore fall outside the recovery points already preserved.
How the Microsoft 365 sign-ins worked
An app-only sign-in uses an application identity, called a service principal in Microsoft Entra ID, rather than a human user account. Huntress said the Cloud Backup app used a vendor-held API secret to obtain Microsoft Graph tokens. Because this was application authentication, employee MFA prompts did not apply. Huntress reported unauthorized sign-ins in 162 tenants in its telemetry by 19:00 UTC on October 16. Huntress’s investigation
Microsoft Threat Intelligence characterized the activity as an active supply-chain attack in its post.
ConnectWise directed administrators to Microsoft Entra’s Monitoring > Sign-in logs > Service principal sign-ins view and recommended filtering by the Cloud Backup app ID, 506e08f9-6e9a-4da4-942b-a099a03644ae. The standard User sign-ins view does not display this application authentication.
Huntress reported a separate management-app finding
ConnectWise Cloud Management - MS Teams was a different application from Cloud Backup. Huntress reported that, in one tenant, the Teams management app assigned itself the Global Administrator role and added client secrets to two other applications, including a tenant-specific Huntress app. The sequence took about five minutes. Huntress also observed ConnectWise Cloud Management applications assigning directory roles in nearly 50 monitored tenants, mostly Exchange Administrator. The Teams app’s ID is 24205314-2b89-4e07-a2a4-579e898a5640.
Todyl found no directory changes by the Cloud Backup app in the tenants it examined. Its finding concerned that app; Huntress’s role and credential changes involved the separate Teams management app. Todyl’s investigation
Why some data reads could not be attributed
In monitored tenants with active backup subscriptions, Todyl found read activity it could not attribute to legitimate backup operations or unauthorized use. Both used the same application identity, and the tenants were not collecting Microsoft Graph activity logs with per-request source IPs—information that could distinguish who made each request.
For monitored tenants without an active subscription, Todyl reported no mailbox or file read records after token issuance and described that as no evidence of bulk copying. That observation sits alongside the access and logging findings, rather than determining what happened in every customer tenant.
