- October 16, 2026
Emerging Threat: ConnectWise Cloud Backup for Microsoft 365 Used to Access Customer Tenants
A security notice reports that attackers are using ConnectWise Cloud Backup for Microsoft 365 to reach customer tenants and steal email, SharePoint, and Teams data.
Executive Summary
On October 16th 2026, Connectwise posted a security notice they had acknowledged an ongoing incident involving ConnectWise Cloud Backup for Microsoft 365, formerly offered under the SkyKick name. According to public reports, attackers are using the service to reach customer Microsoft 365 tenants and exfiltrate email, SharePoint, and Teams data. The root cause and the number of affected tenants are not known at the time of writing.
The service backs up Microsoft 365 tenants, so abuse of its access exposes the same mail, files, and Teams content it is meant to protect. Given potential for data theft through a backup integration connected to Microsoft 365 tenants, Beazley Security recommends affected organizations disable ConnectWise Cloud Backup in their cloud enviornments as a precaution until ConnectWise provides additional information about the incident.
Affected organizations should also conduct a thorough review for any signs of compromise. Defenders can find additional information in the Indicators of Compromise section of this advisory.
Affected Systems or Products
Product | Affected Versions |
|---|---|
ConnectWise Cloud Backup for Microsoft 365 (formerly SkyKick) | Cloud service; scope of affected tenants not disclosed at this time |
Mitigations / Workarounds
At the time of writing, no ConnectWise remediation steps or workarounds for this incident have been confirmed. It is advised to disable ConnectWise Cloud Backup as a precaution until ConnectWise shares additional information.
Until ConnectWise publishes guidance, the following may help to reduce risk:
Export and preserve Microsoft Entra ID sign-in logs and the Microsoft 365 unified audit log before making changes, so that evidence of any access is retained.
Disable ConnectWise Cloud Backup for each integrated tenant, record the change, and re-enable the service only after ConnectWise publishes additional guidance and potential remediation steps.
Review each tenant for the indicators listed under Indicators of Compromise and treat any matching activity as suspicious.
Indicators of Compromise
The indicators below come from the ConnectWise security notice and publicly disclosed information from the research community. Notices advise reviewing Microsoft Entra ID sign-in logs and the Microsoft 365 unified audit log for activity tied to the listed App ID, IP address, or user agents. It is also advised to investigate any unusual bulk access to mailboxes, SharePoint, or Teams data, treating activity from these indicators as suspicious.
Indicator | Type | Description |
|---|---|---|
506e08f9-6e9a-4da4-942b-a099a03644ae | Entra App ID | Microsoft Entra application (App ID) tied to the reported activity; review sign-in and audit events for this App ID and disable integration until more information is made available. |
144.172.64[.]128 | IPv4 | Attacker IP address reported in the activity |
Python-urllib/3.12 | User agent | User agent reported in the activity; match as a prefix |
python-requests/2.31 | User agent | User agent reported in the activity; match as a prefix (for example python-requests/2.31.x) |
Technical Details
How attackers gained the ability to act through ConnectWise Cloud Backup has not been confirmed at the time of writing.
How Beazley Security is responding
Beazley Security is proactively hunting across our MDR environments to identify affected integrations and detect signs of attempted exploitation or compromise targeting our clients.
If you believe your organization may have been impacted by this attack and need support, please contact our Incident Response team.