ConnectWise Cloud Backup (formerly SkyKick) has confirmed unauthorized access to application credentials used by its backup platform. Attackers reportedly used the compromised credentials to access Microsoft 365 tenants where the application was installed. As a result, they may have gained access to data and services through the application’s existing permissions.
What is the threat?
ConnectWise Cloud Backup relies on a Microsoft 365 application identity to access and back up customer data. According to security researchers and ConnectWise, attackers compromised credentials tied to this application and used them to obtain authentication tokens in customer and partner Microsoft 365 environments.
The application’s existing permissions may allow attackers to access mailbox data, files, Teams content, and directory information. Because the access is tied to the application rather than a user account, password changes alone may not eliminate the risk.
Why is it noteworthy?
This incident is noteworthy because it involves a trusted third-party application with existing access to Microsoft 365 environments. Attackers can potentially use those permissions to obtain Microsoft Graph tokens and access data across affected tenants.
Security monitoring has identified unauthorized sign-ins linked to the compromised credentials across multiple customer and partner environments. The incident highlights the risks associated with compromised application identities and trusted cloud integrations.
What is the exposure or risk?
Organizations that use ConnectWise Cloud Backup may face unauthorized access to Microsoft 365 data, depending on the permissions granted to the application. Exposed data could include email messages, attachments, OneDrive and SharePoint files, Teams data, and directory information.
Because the compromise involves application-based access, attackers may retain access even after administrators change user passwords. In a worst-case scenario, organizations could face data exfiltration, exposure of sensitive communications, and additional compromise activity through the application’s delegated permissions.
Barracuda XDR SOC has done a threat hunt across all XDR customers and informed the potentially impacted customers.
What are the recommendations?
Barracuda recommends the following actions to reduce risk:
1. Disable Connectwise Cloud Backup application access
In Microsoft Entra Admin Center, locate the SkyKick / ConnectWise Cloud Backup application (Application ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and disable user sign-in access. Do not delete the application.
2. Review service principal sign-in activity
Review service principal sign-in logs for the affected application ID and investigate activity originating from the following IP addresses: 144.172.64.128, 144.172.64[.]99, 144.172.64[.]60, or associated with Python user agents such as Python-urllib/3.12 and python-requests/2.31.
3. Investigate application-based activity
Review Microsoft 365 application and service principal activity for signs of unauthorized access. Do not rely solely on interactive user sign-in logs.
4. Revoke unauthorized access
If suspicious activity is identified, revoke active sessions and tokens and remove unauthorized permissions or consents associated with the affected application.
5. Implement network blocking where appropriate
Consider blocking IP addresses 144.172.64.128, 144.172.64[.]99, and 144.172.64[.]60 as a defense-in-depth measure. However, network blocking alone may not prevent cloud-to-cloud authentication activity.
6. Engage investigation resources
Eligible Barracuda XDR customers can work with the Barracuda SOC to review activity and investigate potential exposure using the published indicators of compromise.
References
For more information, review the following resources:
- https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
- https://www.connectwise.com/company/trust/advisories
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
This post originally appeared on Smarter MSP.