Cynet Threat Update: ConnectWise Cloud Backup Incident

Publisher preview

ConnectWise is investigating unauthorized access involving application identities associated with ConnectWise Cloud Backup, formerly SkyKick Backup. The company publicly disclosed the incident on October 16, 2026. On October 17, it disabled seven application identities associated with Cloud Backup and Cloud Management and revoked certificates used for affected Cloud Backup connections. According to Microsoft Threat Intelligence, the threat actor used the compromised OAuth application to obtain access tokens across customer tenants, likely abusing previously granted permissions, including elevated permissions such as Directory.ReadWrite.All. Microsoft observed suspicious service-principal authentication, Microsoft Graph reconnaissance, and attempts to add credentials for persistent access. ConnectWise reports no evidence that its encrypted backup archives were accessed. However, this finding does not establish whether unauthorized activity occurred inside customers’ Microsoft 365 environments. Cloud Backup remains suspended, including scheduled backups and access to affected restoration capabilities. Cynet’s Research and CyOps teams are investigating available Microsoft 365 and Entra ID telemetry for activity associated with the affected application and reported indicators. The investigation focuses on suspicious application authentication and, where relevant telemetry is available, unexpected credentials, OAuth permission changes, and privileged role assignments that could indicate persistent access.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.