ConnectWise disclosed unauthorized access to Cloud Backup (formerly SkyKick) application identities, with service disruption and phased recovery
Cloud Backup (formerly known as SkyKick) Service Interruption
ConnectWise disclosed that application identities in its Cloud Backup (formerly SkyKick) environment suffered unauthorized access; on October 17 it disabled 7 application identities and revoked the related certificates, suspended the three services Cloud Backup, SaaS Security and Cloud Management, and then restored them in phases. ConnectWise said that, based on threat intelligence shared by Microsoft, the attack appeared to come from a group aligned with the Chinese government that used publicly available agentic AI frameworks to automate and accelerate its operations; according to Microsoft research, the group has been active since 2021 and has also targeted aerospace, energy, finance, government and other sectors, and in some cases attackers obtained privileged cloud access within three hours. ConnectWise said existing backup archives remain encrypted and isolated with no signs of access, and there is no indication that other products were affected, but the investigation itself cannot determine whether the Microsoft 365 tenants of specific partners or customers were compromised, and each must investigate on its own.
ConnectWise disclosed day by day its phased recovery and tenant investigation guidance following unauthorized access to credentials, and cited Microsoft intelligence saying attackers used a publicly available agent framework to accelerate the intrusion.