Compromised ConnectWise Credentials Used to Access Microsoft 365 Tenants and Plant App Secrets

Oct 16, 2026 · Original article ↗

Summary

Huntress confirmed unauthorized Microsoft 365 access using compromised ConnectWise credentials. In two tenants, attackers granted an application Global Administrator and planted secrets in other apps. Data access remains uncertain.

Key points

Huntress confirmed that a compromised ConnectWise Cloud Backup credential was used to obtain Microsoft Graph tokens with permissions already granted in customer tenants; it also assessed other ConnectWise applications as abused.
October 15 authentications from 144.172.64[.]128 progressed through tenants in sorted GUID order, seconds apart, indicating scripted targeting. A later wave unsuccessfully targeted 16 tenants in policy, national security, trade and critical minerals.
In two investigated tenants, an application granted itself Global Administrator and added secrets to other tenant-registered applications for persistence. One affected application was a partner-specific Huntress application.
Private Azure IPv6 addresses also appeared in suspicious activity, but legitimate traffic shared that address space. Huntress cautioned that those addresses alone cannot identify the operator.
Huntress found no evidence of mailbox or file manipulation, or user or policy changes, in the two investigated tenants. Microsoft Graph directory reads leave no audit trail, limiting conclusions about data access.
ConnectWise said it had disabled relevant applications by October 17. Huntress's last observed successful sign-in using the compromised credential was October 15 at 08:44 UTC; subsequent observed attempts failed.
Organizations should disable affected applications without deleting them, review all application credentials and unexpected directory roles, and remove unauthorized additions. Disabling the original applications does not invalidate secrets planted in other apps.

Article Details

Attack Vectors: A compromised vendor application credential was used to obtain Microsoft Graph tokens and access customer tenants with the application's existing permissions. The credential could authenticate wherever the application was consented.
In two reviewed tenants, an abused application granted itself Global Administrator and planted client secrets on other tenant-registered applications to maintain access. Disabling the original application does not invalidate these additional credentials.
Scripted authentication attempts traversed tenants in sorted GUID order. A later, unsuccessful wave targeted 16 tenants in policy, national security, trade, and critical mineral sectors; missing service principals prevented access in tenants without the relevant application.
The infrastructure used for unauthorized application authentication also conducted password spraying against four law firm tenants. Huntress observed no successful user sign-ins from that address.
Defensive Notes: Disable affected application service principals rather than deleting them, and review other related applications. Do not re-enable them until the vendor confirms all credentials have been reset. The October 17 update reports that the vendor had disabled relevant apps.
Review client secrets and certificates on all Enterprise applications and App registrations, especially management and security applications, for unexpected additions since October 13, 2026. Remove unauthorized credentials; rotating the original vendor credential alone is insufficient.
Review directory-role assignments and remove unintended privileged roles after disabling the affected applications. Investigate applications assigning themselves roles or modifying other applications.
Audit service principal sign-ins, not just user sign-ins, and review activity from approximately 01:00 UTC on October 15 through 02:00 UTC on October 16, 2026. Correlate initiating application, target, operation, result, and user agent.
Do not treat private cloud IPv6 addresses or common Python and curl user agents as conclusive attribution. Legitimate traffic shared the private address range, and these user agents are not unique to the activity.
A clean audit log does not rule out data access: Microsoft Graph directory reads may leave no audit trail. The two reviewed tenants showed no evidence of mailbox or file manipulation, or user or policy changes, but data access could not be excluded.
Review Conditional Access exclusions, restrict application credential creation and lifetimes, limit application administrator roles, and consider workload-identity access restrictions and risky-service-principal monitoring.
Disabling the backup application pauses automated backups but does not delete existing stored backups or interrupt ordinary user sign-ins, email, files, or Teams messages. Confirm retention and restore options with the vendor.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]64[.]128`	Infrastructure confirmed as associated with unauthorized vendor-credential application sign-ins on October 15, 2026; also used for password spraying against law firm tenants on October 13–14.
IPV4	`144[.]172[.]64[.]60`	Additional suspicious IP shared in ConnectWise's advisory; Huntress observed a few failed user logins on October 18, 2026, but no application sign-ins and no established connection to the application compromise.
IPV4	`144[.]172[.]64[.]99`	Source of concentrated failed user password spraying on October 10–14, 2026. Huntress observed no application sign-ins from it and did not believe the spraying was related to the application compromise.
IPV4	`144[.]172[.]94[.]243`	Source of ongoing broad failed login spraying against many organizations. Huntress observed no application sign-ins from it and did not believe the spraying was related to the application compromise.