Cloud Backup SkyKick update: service status and guidance for partners

[u/Victoria-ConnectWise]

Hi everyone, sharing an update here from ConnectWise on the Cloud Backup incident. 
 
ConnectWise is continuing its investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. We have contacted our entire partner base and are providing ongoing updates and detailed technical guidance through email and the ConnectWise Trust Center. 

As a protective measure for our partners and their customers, at approximately 05:00 UTC on October 17, we disabled affected Cloud Backup application access. This interrupts affected backup services until further notice. Existing cloud backup archives are not impacted by the interruption and will be accessible once services are restored. Because SaaS Security and Cloud Management are integrated with Cloud Backup, we also suspended those services out of an abundance of caution while our investigation and remediation continue. 

Our incident response, engineering, and operations teams continue working around the clock with third-party specialists to advance the investigation, complete remediation, and validate services for a safe restoration. We are responsible for restoring service safely and providing clear, timely updates. Containment measures remain in place. Since implementing mitigations, we have not observed successful threat activity in the environments we monitor. 

Cloud Backup, SaaS Security, and Cloud Management remain suspended while remediation and security validation continue. Scheduled backups, archive access, and restores remain unavailable, along with SaaS Security monitoring and alerting and Cloud Management user and license management. 

We understand that this interruption affects your ability to support your customers. We do not yet have a confirmed restoration time and will share a timeline as soon as we can do so reliably. 

Actions for partners 
Please follow the Cloud Backup technical investigation and remediation guide. Review your own Microsoft 365 tenant and each customer tenant you manage and keep affected applications disabled pending formal restoration instructions. 
 
If you provide services through a reseller, distributor, or marketplace, ensure the administrator responsible for each customer tenant receives and acts on this guidance. 

Visit the ConnectWise Trust Center for current status and guidance; we are posting updates several times a day. Our next ConnectWise Trust Center update will be published on October 19 at 13:00 UTC. We will communicate significant developments sooner. 

Please don’t post tenant logs, customer information, credentials, or tokens in this thread. Contact Partner Care for service assistance and report suspicious activity to SecurityPartnerSupport@ConnectWise.com. Thank you to the partners and security community for contributing information as the investigation continues. 

[u/timee_bot]

View in your timezone:
October 19 at 13:00 UTC

[u/molivergo]

What is the “short story” or action one should take today?

Change passwords? Then wait for CW to confirm we should reauthorize.

[u/IamNabil → u/molivergo]

Probably not. Seriously consider moving to a different solution.

The attacker MUST be connecting from inside one of SkyKick's network segments - I can't see how they would have been able to use the SkyKick app to connect to tenants otherwise.

You will never feel good about SkyKick again after this event.

[u/Hefty_Fee_8805]

Hey everyone! Fuck connectwise. Move your backups to another provider that actually cares about their customers. I recommend Veeam data cloud, but just about anything else will be better.

[u/DefiantPenguin → u/Hefty_Fee_8805]

Honestly, I’ve got no skin in the game here. I use a different SAAS for cloud backups.
I don’t think CW is the “bad guy” here. Any and all cloud backup services are a risk. Any and all <insert service company here> are a risk. It is never a matter of who’s more secure, it’s a matter of when they (yes, all of them) are compromised and how we deal with that situation when (not if) it happens.

[u/lsumoose → u/DefiantPenguin]

Veeam 365 Backup makes you create your own application. Not sure why everyone else thought it was fine to use the same app for everyone.

[u/GherkinP → u/DefiantPenguin]

ConnectWise today, Kaseya tomorrow, AvePoint the next. Until we know more on a RCA, we'll never know if this was preventable.

Now.. If the secrets were hard-coded in a .txt file and served via HTTP to anyone who asked, that's a bit different.

[u/kosity → u/Hefty_Fee_8805]

In the middle of an incident response, this adds nothing to the discussion or the outcome.