A major security breach involving ConnectWise Cloud Backup (formerly known as SkyKick) has exposed hundreds of Microsoft 365 tenant environments to unauthorized access. The incident unfolded when attackers successfully compromised administrative application credentials belonging to the backup service, turning a trusted vendor's master keys into access vectors for hundreds of enterprise systems.

Microsoft has attributed the malicious campaign to a threat cluster designated as Storm-0940, a group security researchers link to state-sponsored operations originating from China. The attackers leveraged advanced automated methodologies, including the use of an open-source, AI-driven penetration testing framework known as ARTEX, to accelerate reconnaissance and achieve high-level privileges within compromised networks in a matter of hours.

The breach specifically targeted the service integrations utilized by Managed Service Providers (MSPs). Because Cloud Backup requires deeply integrated permissions—including directory administrator capabilities—to protect corporate data, the theft of these application keys granted intruders extensive visibility. Once inside, the threat actors utilized Microsoft Graph for reconnaissance, injected unauthorized credentials to maintain persistence, and harvested sensitive data from Azure Key Vaults and SharePoint repositories.

In response to the emergency, ConnectWise took immediate precautionary action by disabling multiple application identities, revoking shared certificates, and temporarily suspending its Cloud Backup, SaaS Security, and Cloud Management platforms. While existing customer backup archives remain isolated and encrypted, the disruption has left scheduled backups and restores temporarily offline while remediation efforts continue.

Security analysts emphasize that this incident does not stem from a traditional software vulnerability or a CVE, meaning there is no standard software patch to install. Instead, the breach highlights the mounting risks of supply-chain trust dependencies, where a single compromised third-party vendor can expose countless downstream client environments.

Administrators utilizing ConnectWise Cloud Backup or former SkyKick services are strongly urged to audit their Microsoft Entra ID environments immediately. Security teams must preserve audit and sign-in logs, disable rather than delete impacted application identities to retain forensic evidence, check for unauthorized credential additions, and review role assignments to ensure no unauthorized accounts possess Global Administrator privileges.