ConnectWise Investigating Unauthorized Access to Cloud Backup App

ConnectWise is investigating attempts of unauthorized access tied to its Cloud Backup for Microsoft 365 service (formerly known as SkyKick Cloud Backup). The company disclosed the incident on October 16, noting that containment measures were in place and that it had no indication that partner backup data was accessed.

Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure. Coalition identified policyholders using adjacent ConnectWise SaaS technology, while Wirespeed identified its customers with the backup application in their Microsoft 365 tenants.

Immediately, we orchestrated outreach to begin notifying all impacted parties.

What ConnectWise has confirmed

ConnectWise disclosed the incident on October 16, noting that it initiated incident response procedures, has containment measures in place, and has no indication that partner backup data was accessed. The investigation is ongoing.

Separate public reports in the MSP community describe an attacker using the backup service's Microsoft Entra application to access customer tenants and exfiltrate email, SharePoint, and Teams data. ConnectWise has not confirmed these reports.

ConnectWise published the following indicators associated with the suspicious authentication activity. ConnectWise notes their presence alone does not confirm compromise.

• Source IP: 144.172.64.128

• User agents: Python-urllib/3.12 and python-requests/2.31

The application appears in Microsoft Entra as "SkyKick Backup" or "ConnectWise Cloud Backup," with App ID 506e08f9-6e9a-4da4-942b-a099a03644ae.

Why backup applications carry elevated risk

Cloud backup services for Microsoft 365 connect through a Microsoft Entra application that an administrator approves with tenant-wide permissions. The application then accesses data on its own, without a user sign-in, password, or MFA prompt. This is required for unattended backups.

Those permissions extend to anyone who can authenticate as the application. If its credentials are compromised, access is possible in every tenant that approved it, at the level the backup service already holds, typically read access to mail, SharePoint, and Teams.

This activity can be difficult to detect. Bulk reads of mailboxes and files are normal for a backup service, and user-focused controls such as MFA do not apply to application sign-ins. Because MSPs often deploy one backup vendor across many clients, a single vendor incident can affect a large number of organizations.

Recommended actions

The following steps apply to organizations that use ConnectWise Cloud Backup (SkyKick) for Microsoft 365, directly or through an MSP. The presence of the application in a tenant confirms the organization is a customer. It does not indicate compromise.

1. Disable the application

In Microsoft Entra, open Enterprise applications and locate "SkyKick Backup" or "ConnectWise Cloud Backup," or search by App ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Under Manage → Properties, set "Enabled for users to sign-in" to No. Backups will stop while the application is disabled. Re-enable it after ConnectWise confirms remediation.

2. Search for the indicators

Review Entra sign-in logs and the Microsoft 365 unified audit log for activity tied to the App ID, IP 144.172.64.128, or the user agents Python-urllib/3.12 and python-requests/2.31.

3. Review access volume

Investigate unusual bulk access to mailboxes, SharePoint, or Teams, particularly outside the backup service's normal schedule.

4. Preserve logs

Export the relevant sign-in and audit logs. Default retention periods may be shorter than an investigation requires.

5. Report suspicious activity

Coalition policyholders who find activity matching these indicators should contact Coalition.

How Coalition and Wirespeed are responding

Coalition sent a Zero-Day Alert to policyholders who expose ConnectWise SaaS usage. Coalition cannot determine from external data which of those organizations use the backup service, so the alert was precautionary and included steps for each recipient to check.

Based on early community reports, security teams across Coalition and Wirespeed began investigating the incident prior to the disclosure.

Wirespeed's visibility into the Microsoft 365 tenants it monitors allows it to identify which customers use the backup service and whether the known attacker activity appears in their environments. All Wirespeed customers using the service have been notified.

Next steps

Coalition and Wirespeed will continue monitoring and will update guidance when ConnectWise confirms remediation. Policyholders who find activity matching the indicators above should contact Coalition.

Wirespeed has launched new Managed Detections to alert on any malicious activity related to the ConnectWise Cloud Backup for Microsoft 365 to help ensure the platform responds automatically. Organizations should also review which third-party applications have access to their Microsoft 365 tenant, including those connected by an MSP, under Enterprise applications in Microsoft Entra.

EASILY SPOT & STOP CYBER THREATS IN ONE PLACE

Coalition Control

Take control of your cyber risk >

This blog post is designed to provide general information on the topic presented and is not intended to construe or render legal or other professional services of any kind. If legal or other professional services are required, the services of a professional should be sought. Descriptions of coverage are for general informational purposes only and are subject to the terms and conditions, including the limitations and exclusions, of the applicable policy. The reader is cautioned to consult independent professional advisors and formulate independent conclusions and opinions regarding the subject matter discussed herein. Coalition makes no representations as to the accuracy or completeness of this content. Any action taken based on this information is at the sole discretion and risk of the reader. Coalition and its affiliates expressly disclaim any liability for losses or damages resulting from the use of or reliance on this information, which is used strictly at the reader’s own risk. The blog post may include links to other third-party websites. These links are provided as a convenience only. Coalition does not endorse, have control over nor assume responsibility or liability for the content, privacy policy or practices of any such third-party websites.

Copyright © 2026. All rights reserved. Coalition, Wirespeed, and the Coalition logo are trademarks of Coalition, Inc. All other products and company names are the intellectual property of their respective brand owners.