ConnectWise Disables Application Identities After Microsoft 365 Tenant Compromise
Summary
ConnectWise disabled seven application identities and suspended Cloud Backup after attackers accessed the identities and compromised Microsoft 365 tenants. Huntress reported nearly 1,000 tenants with related sign-ins, including 300 successful ones.
Key points
- ConnectWise said it identified the incident on October 14, 2026, and disabled seven application identities and suspended Cloud Backup on October 17.
- Scheduled backups and access to affected archives and restorations are unavailable. ConnectWise said archives remain encrypted and preserved, with no evidence they were breached or accessed.
- ConnectWise also temporarily took SaaS Security and Cloud Management offline. The credential-exposure mechanism remains under investigation, and the company has not established whether a product vulnerability contributed.
- Huntress reported malicious sign-ins from an associated IP address through October 15, and said it confirmed abuse of the Teams application in one tenant.
- Huntress identified nearly 1,000 Entra tenants with sign-in activity from the associated IP address, including 300 successful sign-ins. It said a missing service principal prevented access in some tenants.
- Huntress advised partners to limit application credentials and administrator roles, and consider workload-identity Conditional Access and Entra ID Protection.
Article Details
- Victim Organization
- ConnectWise and affected customer Microsoft 365 tenants
- Incident Type
- Unauthorized access to ConnectWise application identities and compromise of Microsoft 365 tenants using application credentials
- Operational Impact
- ConnectWise suspended Cloud Backup, so scheduled backups stopped and access to affected backup archives and restoration capabilities became unavailable. SaaS Security and Cloud Management were temporarily taken offline. ConnectWise said existing backup archives remained encrypted, isolated, and preserved, with no evidence they were breached or accessed.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | IP address Huntress associated with unauthorized activity; Huntress reported a second targeted wave of unsuccessful attempts from it. |
MITRE ATT&CK
People
Vendors
ConnectWiseConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the applicationMicrosoftwhich unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.
Products
Cloud ManagementOut of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.ConnectWise Cloud Backupprovider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.Microsoft 365 Apps for Enterpriseunknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.Microsoft Entra IDcredential to authenticate as that application, the attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions.SaaS SecurityOut of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.SkyKick"For the new target set, the first sweep targeted Graph tokens from the SkyKick app and occurred on October 15 between 09:25:04 and 12:35:50 UTC," Huntress said. "The second sweep hit the same tenants on the same date,