Huntress has become aware of a widespread security incident involving ConnectWise ...

X • October 16, 2026

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).

We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

This activity is an application sign-in with a vendor credential, not a user sign-in. The IP address from which the activity originated is 144.172.64[.]128.

So far, we have seen over 100 compromised tenants. We have taken proactive measures for impacted Huntress ITDR partners. You’ll be hearing from our team via a phone call if you haven’t already.

Impacted organizations should immediately disable this application (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) in the Entra Admin Center, following the instructions here.

Huntress is monitoring the situation closely alongside our security partners, and will update this thread as more information becomes available.

Here’s the link to the advisory from ConnectWise:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Compromised ConnectWise Credentials Target 173 Microsoft 365 Tenants On October 15, 2026, threat actors exploited compromised credentials from ConnectWise Cloud Backup to access Microsoft 365 environments of 173 customers. The attackers used the vendor's application sign-in method, obtaining Microsoft Graph tokens from the IP address 144.172.64[.]128. This incident affects any organization with the app installed, as the credential can access all tenants where consent was granted. Huntress confirmed unauthorized sign-ins and noted that the attackers moved through tenants in a scripted manner. The compromised app has extensive permissions, allowing access to sensitive customer data. Huntress has advised impacted organizations to disable the application immediately. The situation is under close monitoring by Huntress and security partners. 5 sources 72

Extracted Entities

Huntress has become aware of a widespread security incident involving ConnectWise ...

The full story

Extracted Entities

Attack Types (1)

Companies (2)

IP Addresses (1)

MITRE ATT&CK (1)

Platforms (4)