{"id":91587,"date":"2026-10-19T22:59:52","date_gmt":"2026-10-19T21:59:52","guid":{"rendered":"https:\/\/www.n-able.com\/?p=91587"},"modified":"2026-10-19T23:11:43","modified_gmt":"2026-10-19T22:11:43","slug":"suspected-connectwise-cloud-backup-security-event-what-we-know-and-how-n-able-is-responding","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/fr\/blog\/suspected-connectwise-cloud-backup-security-event-what-we-know-and-how-n-able-is-responding","title":{"rendered":"Suspected ConnectWise Cloud Backup security event: What we know and how N-able is responding"},"content":{"rendered":"

Beginning on Friday, October 16, 2026, N-able\u2019s Adlumin MDR and Nightscope Threat Research teams have been tracking the now-confirmed compromise affecting the ConnectWise\/SkyKick Cloud Backup app for Microsoft 365.<\/p>\n

What we’ve done<\/h2>\n

On Friday, we engaged in a proactive hunt to identify Adlumin partners and customers who are using this M365 app and have performed outreach if indicators associated with this event. <\/p>\n

N-able\u2019s Adlumin MDR<\/a> and Nightscope Threat Research<\/a> teams have constructed detection logic that will alert on future abuse of the ConnectWise\/SkyKick Cloud Backup application in M365 using documented adversary techniques. This detection is titled \u00ab\u00a0Presumed SkyKick\/ConnectWise Cloud Backup Compromise\u00a0\u00bb.<\/p>\n

This detection has been and will continue to be updated to reflect additional findings as they become known.<\/p>\n

Our MDR Security Operations Center analysts have also engaged in detailed threat hunt activities, turning adversary tactics, techniques, and procedures into actionable findings where applicable. These are being communicated through Adlumin SOC cases.<\/p>\n

Background<\/h2>\n

ConnectWise first identified the issue on their official status pages<\/a> on Friday, October 16, 2026, publishing a source IP address and two observed user agent strings believed to be in use by the adversary. ConnectWise has reported a security incident affecting its Cloud Backup service, formerly known as SkyKick. Many organizations use it to back up Microsoft 365.<\/p>\n

ConnectWise has suspended Cloud Backup while it investigates. It has also paused its SaaS Security and Cloud Management services. Scheduled backups, archive access, and restores are unavailable, and there is no restoration date yet. ConnectWise says existing backup archives remain encrypted and isolated, and it has no evidence they were accessed.<\/p>\n

Threat Observables<\/h2>\n

IPv4 Addresses observed in Entra Sign-in Logs:<\/p>\n