By Cyber-Security and Threat Intelligence Desk
Published: October 2026

Main Facts

A major cyber-security incident involving software vendor ConnectWise has left hundreds of organizations locked out of their critical business systems, scrambling to assess the fallout of a sophisticated supply chain attack. Threat actors successfully compromised a highly sensitive multi-tenant application programming interface (API) credential—specifically tied to the ConnectWise Cloud Backup service (formerly known as SkyKick).

Armed with this critical key, the unidentified attackers bypassed traditional perimeter defenses and multi-factor authentication (MFA) protocols to infiltrate connected Microsoft 365 environments unimpeded. The breach affected core productivity and communication suites, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph, and the Microsoft Partner Center.

In response to the unfolding crisis, ConnectWise temporarily suspended several core offerings, including Cloud Backup, SaaS Security, and Cloud Management. While investigation and remediation efforts are active around the clock, the company has yet to provide a definitive timeline for when fully restored services will be returned to its customer base. Independent security firms, including Huntress and Todyl, have rushed to assist impacted small- and medium-sized businesses (SMBs), publishing urgent indicators of compromise (IOCs) and remediation guides while warning that the true scope of the intrusion may be significantly larger than currently documented telemetry suggests.

Chronology of the Incident

The multi-stage attack unfolded rapidly across a single weekend in October, catching organizations off guard due to the privileged nature of the compromised asset.

• October 15: Microsoft Threat Intelligence observers first flag suspicious, broad-scale successful sign-in activity originating from a malicious IP address. The telemetry indicates early-stage Microsoft Graph API reconnaissance and malicious attempts to introduce alternative credentials into targeted service principals.
• October 17 (05:00 UTC): ConnectWise initiates critical mitigations across its infrastructure, working to sever unauthorized access vectors and monitor environment telemetry.
• Friday (Pre-shutdown phase): Cybersecurity researchers at Huntress observe the initial wave of unauthorized automated sign-ins and malicious activity probes leveraging the ConnectWise application identity.
• Saturday: As telemetry data aggregates, Huntress logs malicious infrastructure sign-in attempts spanning nearly 1,000 Entra tenants, with more than 300 succeeding. Realizing the depth of the breach, ConnectWise officially pulls the plug on its Cloud Backup, SaaS Security, and Cloud Management services, leaving a portion of its customer base stranded without access for days.
• Post-Saturday to Present: ConnectWise, alongside security partners, continues aggressive forensic evaluations. Mitigation fixes halt ongoing live intrusions in monitored networks, but organizations continue to comb through logs to evaluate individual tenant risk.

Supporting Data and Technical Analysis

The mechanics of the attack underscore the inherent vulnerabilities of modern cloud integrations and multi-tenant architectures. According to Jonathan Semon, principal security operations analyst at Huntress, the compromised API secret functioned as a master key. Because it belonged to a multi-tenant application framework, any threat actor possessing the credential could programmatically request access tokens in any tenant where the application was installed, entirely circumventing user interaction or customer approval.

Independent investigations by Todyl reinforced these findings, noting that automated tools executed the sign-ins. These tools possessed the technical capacity to read and write emails, manipulate files, and harvest data across diverse Microsoft 365 applications.

Furthermore, the threat actors did not limit their actions to passive data collection. In heavily compromised environments, security telemetry revealed aggressive persistence mechanisms:

• Privilege Escalation: The service account tied to the compromised application autonomously elevated its own permissions within individual tenants.
• Backdoor Creation: Attackers injected new credentials into alternative applications within the target tenant. Security analysts warn that this clever tactic ensures the adversaries maintain direct, persistent access even after the primary ConnectWise application integration is disabled by the administrator.

Huntress confirmed unauthorized sign-in anomalies across 162 unique tenants within its direct visibility, while stressing that broader telemetry across the wider digital ecosystem points toward hundreds of additional hidden compromises.

Official Responses and Threat Attribution

As of press time, neither ConnectWise nor cooperating cybersecurity investigators have publicly attributed the campaign to a known Advanced Persistent Threat (APT) group, ransomware syndicate, or financially motivated cybercriminal enterprise. No external collective has stepped forward to claim responsibility.

In an official corporate advisory, ConnectWise stated:

"ConnectWise is continuing its investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. We are monitoring our entire environment around the clock. Since mitigations began on October 17 at 05:00 UTC, we have not observed successful threat activity in the environments we monitor. This does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review."

Microsoft Threat Intelligence issued a parallel statement via professional networking channels, detailing the mechanics of the adversary’s post-compromise behavior. Microsoft confirmed that following the initial rogue sign-ins, attackers aggressively pursued Microsoft Graph API reconnaissance to lay down resilient backdoors.

ConnectWise has faced mounting criticism and inquiries regarding the exact vector through which the threat actor acquired the high-level credential. The software vendor has declined to answer detailed press questions regarding the initial breach of the secret itself, maintaining a narrow focus on customer remediation and system recovery.

Implications for the Cybersecurity Landscape

The ConnectWise Cloud Backup breach serves as a stark, sobering reminder of the systemic risks associated with supply chain interdependencies, third-party software vendors, and overly permissive cloud-to-cloud integrations.

1. The Danger of "Super-Privileged" Integrations

Many organizations utilize software-as-a-service (SaaS) tools that require broad permissions across cloud ecosystems (such as Microsoft Entra ID) to function efficiently—such as backups, security monitoring, and migration management. When a vendor’s centralized credential is stolen, the attacker inherits god-mode access across thousands of distinct corporate networks simultaneously. This incident highlights an urgent need for enterprises to audit third-party application permissions regularly.

2. Multi-Factor Authentication Bypass

A common misconception among business leaders is that enforcing Multi-Factor Authentication (MFA) provides a silver bullet against all identity-based attacks. Because the threat actors leveraged an authenticated, highly privileged native API secret, they bypassed standard interactive sign-in mechanisms and user-prompted MFA entirely. Security teams must rethink how they monitor non-interactive sign-ins and service principal manipulations.

3. Supply Chain Vulnerability Management

For managed service providers (MSPs) and SMBs that rely heavily on automated backup platforms, extended downtime directly translates to severe financial and operational paralysis. With ConnectWise’s Cloud Backup service offline for an extended duration, affected companies are struggling to verify the integrity of their disaster recovery assets while simultaneously hunting for active backdoors.

Recommended Next Steps for Affected Organizations

Cybersecurity experts urge all users of the ConnectWise Cloud Backup (SkyKick) application—regardless of whether unusual log activity is immediately visible—to take immediate defensive action:

• Revoke and Disable: Immediately disable and remove any affected application integrations from Microsoft 365 / Entra ID environments.
• Audit Service Principals: Review tenant logs for unauthorized credential additions, suspicious application permission elevations, and anomalous Microsoft Graph API queries.
• Deploy IOCs: Utilize the official indicators of compromise published by ConnectWise and Huntress to sweep corporate networks for lingering malicious infrastructure traces.