[REVISION HISTORY]

ConnectWise Cloud Backup supply chain attack

Updated 3 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-20 08:03 UTC → 2026-10-23 07:33 UTC · added ~~removed~~

A supply chain attack targeting ConnectWise Cloud Backup, formerly known as SkyKick, has compromised numerous Microsoft 365 tenants. Attackers compromised the OAuth application for the service to steal access tokens, allowing unauthorized access to mailboxes, OneDrive, SharePoint, Teams, and directory data. Microsoft confirmed malicious activity involving unauthorized authentication attempts, noting that attackers have been adding credentials for the service principal to compromised environments to maintain persistent access. Cybersecurity firm Huntress reported identifying at least 162 to 173 compromised organizations, though activity from the attacker’s address may have reached nearly 1,000 tenants. The intrusion utilized a client assertion credential residing within the vendor’s own tenant, which allowed attackers to effectively bypass multi-factor authentication (MFA) by exploiting a trusted application identity rather than individual user accounts. In response, ConnectWise has suspended several cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to implement mitigations. This suspension impacts scheduled backups, archive access, restores, and license management. While ConnectWise stated there is currently no evidence that stored backups were accessed, the service halt means customers are temporarily unable to perform data restorations. ConnectWise has revoked the compromised certificates and cancelled the affected credentials. The company has engaged a third-party incident response firm to assist in the investigation and has shared relevant IP addresses and guidance to help managed service providers (MSPs) review their Microsoft 365 environments. Recent developments indicate the scale of the breach may be significantly larger than initially reported. Microsoft security researchers have identified that state-sponsored hackers from China targeted approximately 2,250 organizations. The attackers reportedly utilized AI agents to automate access attempts at a rate of nearly 3,000 connections per minute, a high cadence intended to saturate security team reaction times and bypass traditional detection.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.