Skip to main content

2026 - October SkyKick

Tyler
  • Updated

Update: 

We are receiving a high number of inquiries regarding this vulnerability. We understand that you’re looking for more information about the affected tenant(s) for ConnectWise Cloud Backup. We’ve sent a follow-up email with the Tenant ID and corresponding Tenant/Org Name. 

You can also use Huntress SIEM to match the Tenant ID with the Tenant Name using this query:

FROM logs
| WHERE event.provider == "ITDR"
| STATS tenant_name = VALUES(itdr.OrganizationName) BY itdr.OrganizationId


Summary

Huntress has confirmed that a ConnectWise Cloud Backup (formerly SkyKick Backup) to access Microsoft 365 environments has been compromised by a threat actor. Beginning on or around October 14, 2026, this credential was used to obtain Microsoft Graph access tokens across customer tenants — confirmed directly from Microsoft's own sign-in logs, not from third-party reports.

Am I Affected?

If your organization uses ConnectWise Cloud Backup (formerly SkyKick Backup) for Microsoft 365 backup, the application may be consented in your tenant. To self-assess:

  1. Check whether the app is present in your Microsoft 365 tenant by navigating to the Entra Admin Center → Enterprise Applications and searching for Application ID 506e08f9 (also searchable by name as "SkyKick" or "ConnectWise Cloud Backup"). 
    • NOTE: If you do not see the  Application ID 506e08f9 listed, please remove any filters such as the Enterprise Application filter and search again.
  2. Review service principal sign-in logs in the Entra Admin Center under Monitoring → Sign-in logs → Service principal sign-ins tab (the default User sign-ins tab will not show this activity). Filter by Application ID 506e08f9 and look for any IP addresses outside of Microsoft/Azure ranges — the application's normal egress is Azure private IPv6.
  3. Check your unified audit log for any unusual mail access, file downloads, or directory changes between October 14–16, 2026.

Note: Huntress's ability to proactively check sign-in logs is limited to tenants with a Microsoft Entra ID P1 or higher license. If your tenant does not have a P1 or higher license, Huntress cannot verify your status via API — manual log review is recommended.

Recommended Next Steps

  1. Disable the application immediately in your Microsoft 365 tenant if you have not already been contacted by Huntress: In the Entra Admin Center → Enterprise Applications → find the app by ID 506e08f9 → Properties → set "Enabled for users to sign-in" = No.
  2. Do not delete the application — disabling it is sufficient to revoke access and allows it to be safely re-enabled later without requiring a new consent process.
  3. Do not re-enable the application until ConnectWise officially confirms the compromised credential has been rotated. Monitor the ConnectWise Trust & Security Advisories page for updates.
  4. Review your Microsoft 365 audit logs for any unusual activity between October 14–16, 2026, particularly around mail access, file downloads, or user/group changes.
  5. Contact Huntress Support immediately if you observe any suspicious activity or have questions about your environment's status.

What disabling does to your operations: Disabling this app temporarily pauses automated backups and restores while it remains disabled. It does not affect your daily operations — email, files, Teams, and user logins continue working normally. It also does not delete any existing backups.

Additional Resources

ConnectWise Advisory - https://www.connectwise.com/company/trust/advisories

 

Related articles