Oct 19, 2026 · 34 min · 10 segments
Recent arrests, fraud allegations, and investigations involving ransomware negotiators and cybersecurity professionals are raising serious questions about trust in the digital forensics and incident…
And over the weekend, we've seen something come out from ConnectWise, right? Where their cloud backup, formerly known as Skykick service, had a massive interruption.
So when I've first seen this story come up, I'm like, what are these MSPs doing? Again, like, why are we not deprecating tools that are being used as a one-time project and being able to, you know, Leave a foothold essentially inside of a 365 tenancy with essentially administrative passwords or administrative access to all the mailboxes because it's pulling from Bob, Jan, you know, Bill, everybody's email account from the old system to the new.
At the time of this story was coming out and I started going in and I started, if you caught it, you know, you see me kind of like my brain rebooted a couple of times as I went through this story.
I did not know that in 2015, Skykick actually started doing 365 backups at the same time.
So it took me a while to go through this and really start doing some Google searching and stuff like that to really figure out, like, what the hell are we talking about right now? As of recording this at 1 p.m.
Eastern Standard Time of October 19th, there is yet another update that I haven't even looked at yet.
But they essentially shut down the backup repository and, you know, allowing people to, you know, or telling people, you know, disable it on your side.
There was several application IDs that were being leveraged by the the tool to be able to do effectively backups and other things like that.
We do have a couple of new IP addresses that are being listed in here, all pretty much in the same subnet of 144.172.64.x. We have one that was previously stated and then .60 and .99 are the new ones.
So even if you don't have this, you may just want to start looking in your 365 tendency for the, you know, weird IP connection requests from those specific IPs.
And, you know, since all three of them are coming from the same subnet, you might just want to, you know, keep an eye out on an entire slash 24 subnet, to be honest with you at this point.
So, you know, if you are using Skykick for your 365 cloud backup Definitely pause, come back to this thing later.
But yeah, if you're watching on screen, you got the ConnectWise cloud backup, the cloud management, which I guess is almost like a competitor.
And over the weekend, we've seen something come out from ConnectWise, right? Where their cloud backup, formerly known as Skykick service, had a massive interruption.
So when I've first seen this story come up, I'm like, what are these MSPs doing? Again, like, why are we not deprecating tools that are being used as a one-time project and being able to, you know, Leave a foothold essentially inside of a 365 tenancy with essentially administrative passwords or administrative access to all the mailboxes because it's pulling from Bob, Jan, you know, Bill, everybody's email account from the old system to the new.
At the time of this story was coming out and I started going in and I started, if you caught it, you know, you see me kind of like my brain rebooted a couple of times as I went through this story.
I did not know that in 2015, Skykick actually started doing 365 backups at the same time.
So it took me a while to go through this and really start doing some Google searching and stuff like that to really figure out, like, what the hell are we talking about right now? As of recording this at 1 p.m.
Eastern Standard Time of October 19th, there is yet another update that I haven't even looked at yet.
But they essentially shut down the backup repository and, you know, allowing people to, you know, or telling people, you know, disable it on your side.
There was several application IDs that were being leveraged by the the tool to be able to do effectively backups and other things like that.
We do have a couple of new IP addresses that are being listed in here, all pretty much in the same subnet of 144.172.64.x. We have one that was previously stated and then .60 and .99 are the new ones.
So even if you don't have this, you may just want to start looking in your 365 tendency for the, you know, weird IP connection requests from those specific IPs.
And, you know, since all three of them are coming from the same subnet, you might just want to, you know, keep an eye out on an entire slash 24 subnet, to be honest with you at this point.
So, you know, if you are using Skykick for your 365 cloud backup Definitely pause, come back to this thing later.
But yeah, if you're watching on screen, you got the ConnectWise cloud backup, the cloud management, which I guess is almost like a competitor.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.