bloodhound

ConnectWise Cloud Backup (formerly SkyKick) Incident On October 16, 2026, at 21:22 UTC, SpecterOps security researchers learned of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick) from a public Huntress post. Huntress confirmed that an unknown threat actor abused access obtained through SkyKick to reach customers’ Microsoft 365 environments, and reported more than 100 compromised tenants at the time of its post. We want to make sure that you are aware of this ongoing campaign so that you can take appropriate action. The SpecterOps team recommends the following actions: 1. Immediately disable application 506e08f9-6e9a-4da4-942b-a099a03644ae in the Entra admin center. 2. Download AzureHound (if you have not already done so) and run the collector. 3. Ingest the data in BloodHound 4. Run the queries below 5. Review your sign-in logs for service principal authentication tied to the application IDs listed above. Pay special attention to activity from the source IP 144.172.64[.]128. 6. Revoke unneeded application consents. If you don’t actively use SkyKick or ConnectWise Cloud Backup, remove their application consents from your tenant. Related BloodHound Cypher Queries Identify outbound control of ConnectWise application  MATCH p=(sp:AZServicePrincipal)-[r]->(target)  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’  RETURN p Identify outbound control of ConnectWise application  MATCH p=(sp:AZServicePrincipal)-[r]->(target)  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’  RETURN p  Identify paths from the impacted service principal to Tier Zero.  MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t))  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’    AND t.system_tags CONTAINS ‘admin_tier_0’ Identify paths from the impacted service principal to Tier Zero.  MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t))  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’    AND t.system_tags CONTAINS ‘admin_tier_0’