Affected Systems

ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.

Exploitation Status

Active exploitation confirmed. Attackers accessed application identities and compromised Microsoft 365 tenants through supply-chain attack. Service has been shut down by vendor.

Business Impact

Organizations using ConnectWise Cloud Backup have lost backup service access and may have experienced unauthorized access to Microsoft 365 tenants. Potential data exposure, credential compromise, and business continuity disruption. MSPs and their downstream customers are at risk. No CVE assigned yet.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately audit all Microsoft 365 tenants that were backed up by ConnectWise Cloud Backup for unauthorized access, new application registrations, and privilege escalations
  • Review Azure AD sign-in logs and unified audit logs for suspicious activity originating from ConnectWise application identities
  • Rotate credentials and revoke application permissions previously granted to ConnectWise Cloud Backup service
  • Implement alternative backup solution for Microsoft 365 data and verify backup integrity
  • Monitor ConnectWise security advisories for incident details, timeline, and remediation guidance