ConnectWise Disables Application Identities and Suspends Cloud Backup Following Microsoft 365 Tenant Compromises

IT management software provider ConnectWise has taken swift and sweeping defensive actions following a security incident that exposed vulnerable application identities to unknown threat actors, who subsequently used the compromised credentials to breach Microsoft 365 customer tenants.

As part of its ongoing investigation and containment efforts, ConnectWise announced that it has successfully disabled seven distinct application identities linked to the unauthorized access. The decision to revoke these application connections forms a core pillar of the company’s emergency response strategy, designed to halt ongoing exploitation paths and secure its broader ecosystem against further malicious intrusion.

The decisive administrative actions began on October 17, 2026, at precisely 07:00 UTC. Alongside the deactivation of the targeted application identities, ConnectWise implemented a suspension of its Cloud Backup service. This step involved systematically revoking the cryptographic certificates utilized for affected application connections across the entire user base, effectively cutting off a vital pipeline that threat actors had begun to leverage during the operation.

Addressing its user community, the software vendor clarified the exact scope and limitations of the emergency mitigations. Disabling the affected connections successfully blocks any new authentication attempts routed through those specific channels. However, the company explicitly noted that these remote interventions do not automatically reverse changes or configurations previously executed inside an already compromised tenant by malicious actors.

Furthermore, ConnectWise confirmed that the affected shared Cloud Backup credentials are permanently invalid. While previously issued access tokens may theoretically remain operational until they naturally expire or undergo explicit invalidation, the company stressed that any unauthorized credentials, permission expansions, or alternative access vectors established separately by the intruders require thorough, independent review and localized remediation by affected organizations.

The disruptions extend to routine operational capabilities. ConnectWise acknowledged that scheduled backups are currently non-functional, and direct access to affected backup archives and restoration capabilities remains temporarily restricted. Despite these operational hurdles, the company emphasized a critical security reassurance: existing backup archives remain fully encrypted, isolated, and safely preserved. Rigorous preliminary analyses indicate zero evidence suggesting that these archives were breached, exfiltrated, or accessed by the attacking parties.

Out of an abundance of caution, ConnectWise expanded its defensive posture by temporarily taking both its SaaS Security and Cloud Management platforms offline. This proactive pause remains in effect while security engineering teams complete a comprehensive review of the security incident and verify the integrity of the underlying cloud environments.

The sophisticated attack sequence first came to light on October 14, 2026. According to the company, advanced cybersecurity monitoring and routine diligence internal systems flagged anomalous patterns, instantly triggering the activation of comprehensive internal and external incident investigation protocols.

Since deploying these multi-layered mitigations, ConnectWise reports that its monitoring systems have registered zero successful threat activities within the directly monitored environments. Nevertheless, the company offered an important caveat regarding visibility, noting that this finding does not automatically determine the security status of downstream customer environments, which—by architectural design—fall outside direct vendor observation.

At this early stage of the forensics analysis, ConnectWise stated that it remains unclear whether an underlying software vulnerability directly contributed to the initial compromise of the application identities. The exact mechanism through which the sensitive credentials were exposed is currently the subject of an exhaustive, ongoing technical analysis conducted alongside cybersecurity experts.

Security analysts have highlighted the inherent danger of this attack vector, which allows adversaries to exploit trusted application credentials to pierce customer Microsoft 365 environments without needing to harvest individual user passwords. By leveraging a stolen application credential to authenticate as the legitimate application itself, an attacker can seamlessly request valid access tokens from Microsoft Entra ID, governed entirely by the application’s pre-existing permission scope.

Depending on the breadth of permissions originally granted to the application, this level of access can empower malicious actors to traverse various interconnected Microsoft services. Potential exposure points include corporate mailboxes, sensitive SharePoint document repositories, Teams communication streams, and internal directory information.

Because IT management and backup solutions traditionally operate with extensive administrative permissions to execute complex maintenance tasks, the theft of these credentials grants threat actors a powerful foothold. Operating as the application, intruders can aggressively expand their footprint within a tenant. Tactics observed in similar advanced campaigns include elevating privileges by adding the compromised application to the Global Administrator role, injecting client secrets into other trusted applications housed within the tenant, and provisioning entirely new applications equipped with elevated privileges.

These newly minted client secrets establish reliable persistence within the targeted infrastructure. Even if security teams eventually identify and revoke the original compromised credential, the lingering secondary secrets provide threat actors with an alternative mechanism to quietly regain entry to the compromised environment.

Second, Targeted Wave of Attempts Observed

The threat landscape surrounding the incident demonstrated persistent, manual operator activity even as initial defenses were being planned. Jon Semon, Principal Security Operations Analyst at Huntress, shared critical observations regarding the timeline of the threat actors’ operational tempo.

"We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day," Semon stated in an interview with security researchers. He added that while ConnectWise’s termination of Cloud Backup access should theoretically halt activity through that specific channel, lingering risks remain if threat actors successfully injected secondary application credentials into Microsoft tenants prior to the remediation.

Huntress confirmed that its telemetry has not registered new malicious activity originating from the primary vectors since October 15, noting no immediate indication that the threat actors halted operations in response to public disclosures. However, analysts warn that adjacent risks persist.

"We have high confidence the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and we have confirmed abuse of the Teams app in one tenant," Semon warned. Because those specific integration apps were not immediately disabled by ConnectWise during the initial sweep, security teams are actively investigating potential residual activity tied to them.

As investigative efforts deepened late into Saturday, Huntress uncovered evidence of a second, highly targeted wave of intrusion attempts. Traced back to the IP address 144.172.64[.]128 and occurring on October 15, these manual efforts concentrated on a remarkably narrow scope of just 16 distinct tenants. Significantly, the targeted organizations operated primarily within sensitive sectors, including government policy, national security, international trade, and critical minerals.

Detailing the mechanics of this secondary push, Huntress reported that the first operational sweep homed in on Graph tokens from the SkyKick application between 09:25:04 and 12:35:50 UTC. A subsequent sweep struck the exact same group of tenants later that afternoon, between 13:54:39 and 14:20:24 UTC. This second wave exhibited distinct characteristics of manual operation, systematically targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Microsoft Entra ID, and the core Office 365 Management APIs.

Across the broader operational landscape, the managed security service provider has identified nearly 1,000 Entra tenants displaying sign-in activity originating from the suspicious IP address. Of those identified instances, approximately 300 attempts achieved successful authentication. However, security analysts noted that structural safeguards—specifically the absence of a required service principal configuration within certain tenants—successfully blocked the threat actors from escalating the successful sign-ins into full operational access.

In light of these persistent risks, cybersecurity authorities and managed service providers continue to urge partners to audit their environments closely. Security experts point out that leveraging native Microsoft Entra controls can substantially mitigate potential damage if application credentials are ever compromised in the future.

Application management policies, for instance, can be configured to tightly restrict or entirely block client secrets on standard app registrations while enforcing strict caps on credential lifetimes. Furthermore, limiting the roster of personnel holding powerful administrative designations, such as the Application Administrator and Cloud Application Administrator roles, effectively minimizes the pool of users capable of appending unauthorized credentials to enterprise applications.

While advanced mitigations like Conditional Access policies for workload identities—which often require supplementary licensing tiers—can successfully restrict the geographic and network locations from which an application is permitted to sign in, and Microsoft Entra ID Protection can proactively flag anomalous service principals, security researchers emphasize that these controls complement rather than replace rigorous credential reviews. Implementing these layers, however, ensures that any covertly planted secrets remain significantly harder for attackers to weaponize or easier for defenders to spot.

As investigations continue, ConnectWise and external incident response teams maintain round-the-clock monitoring to secure the ecosystem, while affected partners work through recommended remediation steps to safeguard their enterprise tenants.