ConnectWise Investigating Unauthorized Access to Cloud Backup App
ConnectWise is investigating attempts of unauthorized access tied to its Cloud Backup for Microsoft 365 service (formerly known as SkyKick Cloud Backup). The company disclosed the incident on October 16, noting that containment measures were in place and that it had no indication that partner backup data was accessed.
Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure. Coalition identified policyholders using adjacent ConnectWise SaaS technology, while Wirespeed identified its customers with the backup application in their Microsoft 365 tenants.
Immediately, we orchestrated outreach to begin notifying all impacted parties.
What ConnectWise has confirmed
ConnectWise disclosed the incident on October 16, noting that it initiated incident response procedures, has containment measures in place, and has no indication that partner backup data was accessed. The investigation is ongoing.
Separate public reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to access customer tenants and exfiltrate email, SharePoint, and Teams data. ConnectWise has not confirmed these reports.
ConnectWise published the following indicators associated with the suspicious authentication activity. ConnectWise notes their presence alone does not confirm compromise.
Source IP: 144.172.64.128
User agents: Python-urllib/3.12 and python-requests/2.31
The application appears in Microsoft Entra as "SkyKick Backup" or "ConnectWise Cloud Backup," with App ID 506e08f9-6e9a-4da4-942b-a099a03644ae.
Why backup applications carry elevated risk
Cloud backup services for Microsoft 365 connect through a Microsoft Entra application that an administrator approves with tenant-wide permissions. The application then accesses data on its own, without a user sign-in, password, or MFA prompt. This is required for unattended backups.
Those permissions extend to anyone who can authenticate as the application. If its credentials are compromised, access is possible in every tenant that approved it, at the level the backup service already holds, typically read access to mail, SharePoint, and Teams.
This activity can be difficult to detect. Bulk reads of mailboxes and files are normal for a backup service, and user-focused controls such as MFA do not apply to application sign-ins. Because MSPs often deploy one backup vendor across many clients, a single vendor incident can affect a large number of organizations.
Recommended actions
The following steps apply to organizations that use ConnectWise Cloud Backup (SkyKick) for Microsoft 365, directly or through an MSP. The presence of the application in a tenant confirms the organization is a customer. It does not indicate compromise.
1. Disable the application
In Microsoft Entra, open Enterprise applications and locate "SkyKick Backup" or "ConnectWise Cloud Backup," or search by App ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Under Manage → Properties, set "Enabled for users to sign-in" to No. Backups will stop while the application is disabled. Re-enable it after ConnectWise confirms remediation.
2. Search for the indicators
Review Entra sign-in logs and the Microsoft 365 unified audit log for activity tied to the App ID, IP 144.172.64.128, or the user agents Python-urllib/3.12 and python-requests/2.31.
3. Review access volume
Investigate unusual bulk access to mailboxes, SharePoint, or Teams, particularly outside the backup service's normal schedule.
4. Preserve logs
Export the relevant sign-in and audit logs. Default retention periods may be shorter than an investigation requires.
5. Report suspicious activity
Coalition policyholders who find activity matching these indicators should contact Coalition.
How Coalition and Wirespeed are responding
Coalition sent a Zero-Day Alert to policyholders who expose ConnectWise SaaS usage. Coalition cannot determine from external data which of those organizations use the backup service, so the alert was precautionary and included steps for each recipient to check.
Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure.
Wirespeed's visibility into the Microsoft 365 tenants it monitors allows it to identify which customers use the backup service and whether the known attacker activity appears in their environments. All Wirespeed customers using the service have been notified.
Next steps
Coalition and Wirespeed will continue monitoring and will update guidance when ConnectWise confirms remediation. Policyholders who find activity matching the indicators above should contact Coalition.
Wirespeed has launched new Managed Detections to alert on any malicious activity related to the ConnectWise Cloud Backup for Microsoft 365 to help ensure the platform responds automatically. Organizations should also review which third-party applications have access to their Microsoft 365 tenant, including those connected by an MSP, under Enterprise applications in Microsoft Entra.