Last updated: 16 October 2026. Status: investigation ongoing. ConnectWise hasn't yet confirmed the full scope.

Summary

What happened: on 15 October 2026, someone used the ConnectWise Cloud Backup app (formerly SkyKick Backup) to sign in to customers' Microsoft 365 tenants. They used the app's own credential, not a user account, so user MFA and Conditional Access didn't apply.
App ID: 506e08f9-6e9a-4da4-942b-a099a03644ae
IP address: 144.172.64.128 (a hosted server in Australia, not a Microsoft or ConnectWise address)
When: 15 October 2026, 06:53 to 08:47 UTC
Who's at risk: any tenant where this app is installed, including old installs that no longer run backups
Do this now: disable the app in every tenant, check your service principal sign-in logs for the IP, and export those logs before they expire

What to do now

Disable ConnectWise Cloud Backup in every tenant. Steps are below. If you use the backup service, disable it rather than deleting it, so you can switch it back on later without re-consenting. If you don't use it, delete it.
Check service principal sign-ins for App ID 506e08f9-6e9a-4da4-942b-a099a03644ae from 1 October onwards. Look for any IP that isn't an Azure internal IPv6 address (these start with fd).
Check audit logs for role changes made by any SkyKick app, especially Add member to role by SkyKick Cloud Manager - Exchange Online. Remove any assignment you didn't expect.
Remove SkyKick apps you don't use. The full list is below.
Export your logs now. Entra keeps sign-in and audit logs for 30 days with Entra ID P1 or P2, and only 7 days on the free tier. Logs from 15 October will start disappearing from free-tier tenants around 22 October.
Don't re-enable the app until ConnectWise confirms the credential has been rotated.

Indicators of compromise

Type	Value	Notes
App ID	`506e08f9-6e9a-4da4-942b-a099a03644ae`	ConnectWise Cloud Backup. Older tenants may still show it as SkyKick Backup.
IP address	`144.172.64.128`	Hosted server in Australia. App-only sign-ins between 06:53 and 08:47 UTC on 15 October 2026.
App ID	`b78f6a77-d4e5-46fb-87e5-d1648bd02519`	SkyKick Cloud Manager - Exchange Online. Gave itself the Exchange Administrator role between 02:02 and 02:08 UTC on 15 October 2026.
Publisher tenant ID	`3f9cd7a0-127a-4ed4-bf06-2f830d5616b7`	ConnectWise S-K LLC (skykick.com). Every SkyKick app is published from this tenant.
User agents	`Python-urllib/3.12`, `python-requests/2.31`	Reported by other security teams. Visible in Microsoft Graph activity logs, not in sign-in logs.
Where to look	Entra service principal sign-ins	Not the default User sign-ins view.

What we know

The sign-in sweep

The app requested one app-only token per tenant from 144.172.64.128, a few minutes apart.
Tenants were processed in sorted tenant-ID order. That points to a script working through a list, not someone at a keyboard.
The list included tenants with no active backup, so leftover consent from old or cancelled subscriptions was enough to be included.
The app's credential lives in ConnectWise's own tenant. You can't rotate it from your side, so disabling the app is the control you have.
ConnectWise hasn't confirmed whether data was taken. Where backups were running, the attacker's reads look the same as normal backup reads in standard logs, so treat that data as potentially exposed.

What inforcer has seen

Sign-ins from 144.172.64.128 to this app in 28 tenants we monitor, across the UK, EU, US and ANZ, between 06:53 and 08:44 UTC on 15 October. Each tenant got exactly one token.
No other activity from this IP in any tenant we monitor: no user sign-ins or password spray, no Exchange or SharePoint audit events, and no directory changes. We haven't seen the IP again since 08:44 UTC on 15 October.
Where the app isn't installed in a tenant, the sign-in can still succeed, but the token carries no access to data. The risk sits with tenants where the app is installed, even if it's unused.
We don't collect Microsoft Graph activity logs, so we can't see which data each token was used to read.

A second SkyKick app gave itself Exchange Administrator

Between 02:02 and 02:08 UTC on 15 October, about five hours before the sweep, SkyKick Cloud Manager - Exchange Online (App ID b78f6a77-d4e5-46fb-87e5-d1648bd02519) added itself to the Exchange Administrator role in two tenants we monitor. Both were permanent assignments made outside PIM.
It worked through tenants in sorted tenant-ID order, the same pattern as the main sweep. Other MSPs have reported the same thing, including in tenants that haven't used SkyKick for years.
These sign-ins came from inside Azure, not from 144.172.64.128, so searching for the IP won't find them.
We can't yet say whether this was the attacker or a ConnectWise process. Until ConnectWise says otherwise, treat it as suspicious.

How to disable the app

In the Entra admin center (one tenant at a time)

Sign in to entra.microsoft.com for the customer tenant as a Global Administrator, Cloud Application Administrator or Application Administrator.
Open Enterprise applications. Clear the Application type filter or set it to All applications, as the default view can hide this app.
Search for 506e08f9-6e9a-4da4-942b-a099a03644ae. Search by the ID, not the name: the app was renamed from SkyKick Backup to ConnectWise Cloud Backup, so a name search can miss it.
Open the app and check the publisher is ConnectWise S-K LLC (verified publisher ConnectWise LLC).
Go to Properties, set Enabled for users to sign-in? to No, and select Save.

With PowerShell (Microsoft Graph)

Run this per tenant, or loop it across your tenant list. You'll need the Application.ReadWrite.All permission.

Connect-MgGraph -TenantId "<customer-tenant-id>" -Scopes "Application.ReadWrite.All"
$sp = Get-MgServicePrincipal -Filter "appId eq '506e08f9-6e9a-4da4-942b-a099a03644ae'"
if ($sp) {
    Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled:$false
    Get-MgServicePrincipal -ServicePrincipalId $sp.Id | Select-Object DisplayName, AppId, AccountEnabled
} else {
    "App not installed in this tenant"
}

What disabling does

Pauses backups until you switch it back on. Existing backups aren't deleted.
Mail, files, Teams and user sign-ins keep working as normal.
Blocks new tokens straight away. Tokens already issued stay valid until they expire, usually within an hour.
Keeps the app's consent and permissions, so you can re-enable it from the same Properties page.

How to check your logs

In the Entra admin center

Go to Monitoring & health > Sign-in logs and open the Service principal sign-ins tab. The default User sign-ins tab won't show this activity.
Filter by Application ID 506e08f9-6e9a-4da4-942b-a099a03644ae and set the date range to start on 1 October 2026.
Check the IP address column. Normal traffic comes from Azure internal IPv6 addresses starting with fd. Anything else, especially 144.172.64.128, needs a closer look.
For role changes, go to Audit logs, filter Activity to Add member to role, and look for anything initiated by a SkyKick app.

In Microsoft Purview

Run an audit search in Audit covering 15 October 2026, export the results and filter the client IP field for 144.172.64.128. This shows any mailbox, SharePoint or OneDrive activity tied to the IP.

Advanced hunting (Sentinel or Log Analytics)

If you stream Entra logs to Log Analytics:

AADServicePrincipalSignInLogs
| where TimeGenerated > datetime(2026-10-01)
| where AppId == "506e08f9-6e9a-4da4-942b-a099a03644ae"
| where not(IPAddress startswith "fd")
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SignIns = count() by IPAddress, ResourceDisplayName, ResultType

If you have Microsoft Graph activity logs turned on, this shows what was requested from the IP:

MicrosoftGraphActivityLogs
| where TimeGenerated > datetime(2026-10-01)
| where IPAddress == "144.172.64.128"
| summarize Requests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by AppId, UserAgent, RequestMethod, ResponseStatusCode

If Graph activity logs aren't on, turn them on now. They record each request an app makes to Microsoft Graph, which sign-in logs don't.

Other SkyKick apps to review

These are all published from the same ConnectWise tenant. If you don't use them, remove them. If you do, check their audit activity since 1 October.

App name	App ID
SkyKick Backup / ConnectWise Cloud Backup	`506e08f9-6e9a-4da4-942b-a099a03644ae`
SkyKick Partner Portal	`c921256f-04a7-44e8-9b2a-69c33929ba19`
SkyKick Cloud Manager	`2399d300-6fca-4e6a-a686-399fefe75b83`
SkyKick Cloud Manager - MS Graph	`0de14c77-b9b0-4137-9360-34878a929827`
SkyKick Cloud Manager - Exchange Online	`b78f6a77-d4e5-46fb-87e5-d1648bd02519`
SkyKick Cloud Manager - MS Teams	`24205314-2b89-4e07-a2a4-579e898a5640`
SkyKick Platform Partner Center Integration	`412dcf96-176d-4b3a-a1b0-4981ad66971e`
SkyKick Platform Partner Center Integration Partner Tenant AppRegistration	`01d6a108-ad6d-45e2-a3f6-4546744051e6`

Updates from ConnectWise

ConnectWise has acknowledged an issue with its Cloud Backup environment and says it's investigating. It hasn't yet confirmed that the credential has been rotated.
Advisories: connectwise.com/company/trust/advisories
Report suspicious activity to ConnectWise at [email protected].

If you've found this IP or the role change in one of your tenants and want a second pair of eyes, message our support team.