N-able

Soluzioni per MSP e team IT

Sicurezza
Threat Research

Suspected ConnectWise Cloud Backup security event: What we know and how N-able is responding

N-able’s Adlumin MDR and Nightscope Threat Research teams reviewed indicators along with the tactics, techniques, and procedures and are monitoring for potential impact while providing guidance to customers and partners.

By N-able

Ottobre 19th, 2026 2 mins

Content

What we've done Background Threat Observables

Beginning on Friday, October 16, 2026, N-able’s Adlumin MDR and Nightscope Threat Research teams have been tracking the now-confirmed compromise affecting the ConnectWise/SkyKick Cloud Backup app for Microsoft 365.

What we’ve done

On Friday, we engaged in a proactive hunt to identify Adlumin partners and customers who are using this M365 app and have performed outreach if indicators associated with this event.

N-able’s Adlumin MDR and Nightscope Threat Research teams have constructed detection logic that will alert on future abuse of the ConnectWise/SkyKick Cloud Backup application in M365 using documented adversary techniques. This detection is titled “Presumed SkyKick/ConnectWise Cloud Backup Compromise”.

This detection has been and will continue to be updated to reflect additional findings as they become known.

Our MDR Security Operations Center analysts have also engaged in detailed threat hunt activities, turning adversary tactics, techniques, and procedures into actionable findings where applicable. These are being communicated through Adlumin SOC cases.

Background

ConnectWise first identified the issue on their official status pages on Friday, October 16, 2026, publishing a source IP address and two observed user agent strings believed to be in use by the adversary. ConnectWise has reported a security incident affecting its Cloud Backup service, formerly known as SkyKick. Many organizations use it to back up Microsoft 365.

ConnectWise has suspended Cloud Backup while it investigates. It has also paused its SaaS Security and Cloud Management services. Scheduled backups, archive access, and restores are unavailable, and there is no restoration date yet. ConnectWise says existing backup archives remain encrypted and isolated, and it has no evidence they were accessed.

Threat Observables

IPv4 Addresses observed in Entra Sign-in Logs:

  • 144.172.64[.]128
  • 144.172.64[.]60
  • 144.172.64[.]99

User agent strings for initial sign-in activity:

  • python-requests\/2.34.2
  • python-urllib\/3.12
  • python-requests\/2.31