If your business protects Microsoft 365 with ConnectWise Cloud Backup, formerly SkyKick, there are clear steps you can take today. The service is suspended while ConnectWise investigates a stolen app credential. Most of the steps below use settings that are already in your Microsoft 365 admin tools.
On October 15, an attacker used a stolen credential belonging to the backup app to sign in to customer Microsoft 365 environments, which Microsoft calls tenants. Huntress reported the activity and traced it to a hosting provider address. Because the attacker signed in as an app instead of a person, multifactor authentication (MFA) never came into play. In one tenant, a related ConnectWise management app gave itself Global Administrator rights and added new credentials to two other apps.
ConnectWise has taken steps to contain it. On October 17, the company disabled seven of its app identities and revoked the certificates behind them. It also took its SaaS Security and Cloud Management services offline as a precaution. SaaS stands for software as a service. ConnectWise says existing backup archives remain encrypted and isolated. It also says it has no evidence those archives were accessed.
The tradeoff is a gap in protection. As of the company's October 19 update, scheduled backups, archive access, and restores are still unavailable. ConnectWise has not given a restoration date yet.
Many East Texas businesses rely on a managed service provider (MSP) that set up a backup app like this for them. If that describes you, ask your provider whether the steps below are done.
Start in the Microsoft Entra admin center under Enterprise applications. Search for application ID 506e08f9-6e9a-4da4-942b-a099a03644ae, which may still carry the SkyKick name. Open its Properties and set "Enabled for users to sign-in" to No. Then search for "ConnectWise" and "SkyKick" and do the same for the related Cloud Management apps.
Disable these apps, but do not delete them. Deleting an app removes the consent your tenant granted, so you would have to reconnect it from scratch later. Keeping it also preserves its records for any investigation.
Next, open the sign-in logs and choose the Service principal sign-ins tab. Look for activity from three internet (IP) addresses: 144.172.64.128, 144.172.64.99, and 144.172.64.60. A match calls for a closer look, but it does not prove a breach on its own.
Then review every app in your tenant for new secrets, certificates, role assignments, or consent grants added since October 13. This step matters because disabling an app does not remove credentials that were already planted. ConnectWise also notes that access tokens issued earlier may keep working until they expire.
Finally, plan for the backup gap. Confirm when your last good backup ran. Make sure another recovery option covers your mail and files until ConnectWise restores service.
The lasting lesson is a healthy one. Every app you approve in Microsoft 365 keeps the access you gave it. A regular review of those approvals is a simple habit that lowers your risk.
Palestine businesses that want a second set of eyes can start with a Free Assessment from My I.T. Consultants. We can review which apps hold access to your Microsoft 365 tenant and confirm whether the ConnectWise apps are disabled. Call 903-675-5431 to set it up. Hourly work is available during our posted weekday hours. Contract customers are covered 24/7.
