Red Cell Alert: ConnectWise Cloud Backup Unauthorized Access
What happened
On October 16, 2026, ConnectWise disclosed unauthorized access tied to its Cloud Backup for Microsoft 365 service, formerly known as SkyKick Cloud Backup. ConnectWise has opened incident response, and the investigation is ongoing.
Unconfirmed community reports describe an attacker abusing the backup service's Entra application to reach customer tenants and pull mail, SharePoint and Teams data. WatchGuard Red Cell is tracking the incident and will update this post as ConnectWise publishes more detail.
For ConnectWise's official updates, see the ConnectWise Trust Center advisories page.
Why it matters
Backup apps need broad access, which makes them high-value targets. The Cloud Backup app connects with tenant-wide application permissions and no user sign-in, so MFA and most Conditional Access policies never apply.
If the app's credentials are compromised, every tenant that granted it consent is exposed at once. For MSPs, that means a single vendor compromise can reach many client tenants in parallel.
Indicators of compromise
In Entra, the application appears as "SkyKick Backup" or "ConnectWise Cloud Backup". Check Enterprise applications for these application IDs:
| App ID | Status |
|---|---|
| 506e08f9-6e9a-4da4-942b-a099a03644ae | Named in the ConnectWise notice |
| b78f6a77-d4e5-46fb-87e5-d1648bd02519 | Potentially affected |
| 24205314-2b89-4e07-a2a4-579e898a5640 | Potentially affected |
| b2b55f5b-7758-4719-8d8f-88ae172e6bdb | Potentially affected |
Network and client indicators:
| Type | Indicator |
|---|---|
| Source IP | 144.172.64.128 |
| User agent | Python-urllib/3.12 |
| User agent | python-requests/2.31 |
ConnectWise notes that these indicators alone do not confirm compromise. Treat a match as a lead for investigation, not a verdict.
Guidance for ConnectWise partners
If you or your clients use ConnectWise Cloud Backup for Microsoft 365, act now in every tenant where the app is consented.
- Disable the application. In Entra, go to Enterprise applications, open the app, then Manage > Properties, and set "Enabled for users to sign-in" to No. Backups stop while the app is disabled, so re-enable it only after ConnectWise confirms remediation.
- Review third-party apps. Audit every third-party application with access to the tenant under Enterprise applications, and remove any that are unused or over-permissioned.
- Search logs for indicators. Check the Entra service principal sign-in logs and the Microsoft 365 unified audit log for the app IDs, IP address and user agents above. App sign-ins are recorded separately from the unified audit log, so check both.
- Review access volume. Look for unusual bulk access to mail, SharePoint or Teams, especially outside the backup service's normal schedule.
- Preserve logs. Export relevant sign-in and audit logs now, before default retention expires.
Steps 3 to 5 apply to clients without managed detection and response coverage. MDR customers, see below.
WatchGuard MDR customers
The WatchGuard MDR team has reviewed activity related to this incident across monitored tenants. Where we saw suspicious related activity, we proactively disabled the affected accounts and notified you directly.
We are actively threat hunting for new accounts, addresses and related artifacts. If you believe your environment is compromised, contact the MDR team right away.