ConnectWise has suspended its Cloud Backup service, formerly known as SkyKick, after a suspected supply chain attack that security teams first spotted on Wednesday. The company also paused SaaS Security and Cloud Management, since both connect to Cloud Backup. A spokesperson told Cybersecurity Dive that nothing so far shows partner backup data was compromised.
The service matters because of what it can reach. Managed service providers use it to protect Microsoft 365 and Google Workspace data, so it holds access to OneDrive, SharePoint, Teams and directory information. That reach makes a compromised app far more dangerous than a stolen password for one mailbox.
Microsoft Threat Intelligence confirmed on Saturday that it is tracking an active supply chain attack targeting a trusted OAuth app for ConnectWise Cloud Backup. Customers grant this multitenant application permission to operate inside their own tenants, and Microsoft assesses the attacker likely exploited permissions customers had already handed over. Researchers observed broad successful authentication on Thursday from IP address 142.172.64[.]128, followed by Microsoft Graph API reconnaissance and attempts to plant extra credentials as a backdoor.
Huntress described a different angle on the same event. Its blog says a compromised user credential for Cloud Backup gave unauthorized access to Microsoft 365 users, and it confirmed unauthorized sign-ups in 162 customer tenants. Jon Semon, a principal security operations analyst, said a partner tip kicked off an investigation that grew into a rapid response across several Huntress teams.
From a separate hosting address, the attackers tried to sign into more than 1,000 protected Microsoft 365 accounts and succeeded with over 300. Todyl, another security platform for managed service providers, confirmed impact from the same attack.
Anyone running this service should follow ConnectWise’s guidance without delay. Lock down what you can while preserving sign-in and audit records. Go through application and user authentication, application credentials, and federation trusts. Hunt for unauthorized mailbox forwarding rules, unexpected inbox changes, or delegated mailbox access you did not set up, and dig into any identities that changed hands or saw unusual activity during the suspicious window.
A word of caution: the full picture is still coming together. No one has named the attacker yet, and the exact entry point remains an open question. That said, the core lesson is already sitting in plain sight: every vendor you let into your tenant brings your exposure along for the ride.
