ConnectWise Disables Application Identities Following Microsoft 365 Tenant Compromises

IT management software provider ConnectWise announced Saturday that it has taken the decisive step of disabling seven application identities as part of its ongoing, intensive investigation into a security incident involving unauthorized access to its platform and subsequent compromises of Microsoft 365 tenants. The cyber incident, which was first flagged by advanced monitoring systems last week, has triggered urgent responses across the cybersecurity community as researchers uncover targeted waves of malicious activity affecting sensitive sectors.

The unfolding situation began when unknown threat actors managed to obtain unauthorized access to specific application identities associated with ConnectWise. Leveraging this privileged access, the attackers were able to compromise downstream Microsoft 365 tenants belonging to various organizations. In response to the breach, ConnectWise executed emergency remediation procedures on October 17, 2026, at precisely 07:00 UTC. Alongside disabling the seven affected application connections, the company suspended its Cloud Backup service by actively revoking the cryptographic certificates utilized for application connections across its entire user base.

Industry experts and ConnectWise representatives have emphasized the specific nature of these mitigations. While disabling the affected connections effectively cuts off new authentication attempts through those specific pathways, company officials noted that the action does not automatically reverse malicious modifications or configuration changes previously executed inside an individual tenant. Furthermore, the shared Cloud Backup credentials associated with the incident are no longer valid, though previously issued access tokens may theoretically remain operational until they reach their natural expiration or are explicitly invalidated by administrators. Any unauthorized credentials, modified permissions, or alternative vectors of access established through separate identities still require exhaustive manual review and remediation by affected organizations.

The emergency containment measures have inevitably caused temporary disruptions for users. ConnectWise confirmed that scheduled backups are currently paused, and direct access to affected backup archives alongside standard restoration capabilities remains temporarily offline. However, the software provider moved quickly to reassure customers by emphasizing that all existing backup archives remain thoroughly encrypted, isolated, and safely preserved. According to ConnectWise, current forensic analysis shows no evidence that these protected archives were ever breached, exfiltrated, or directly accessed by the threat actors.

Out of an abundance of caution, the company also temporarily took its SaaS Security and Cloud Management offerings offline. This proactive measure was implemented to allow security teams to complete a comprehensive, end-to-end review of the incident and ensure no lingering vulnerabilities could be exploited.

The timeline of the investigation reveals that the issue was first identified on October 14, 2026, through ConnectWise’s advanced cybersecurity monitoring and diligence frameworks. This detection immediately triggered the activation of comprehensive internal and external incident response actions. Since the initial deployment of these robust mitigations, ConnectWise reports that it has not observed any further successful threat activity within the environments under its direct monitoring. Nevertheless, the company explicitly noted that this finding does not automatically confirm the security status of downstream customer environments, which—by architectural design—cannot be directly observed or managed by the vendor.

At this stage in the forensic analysis, it remains unclear whether a specific product vulnerability contributed to the initial compromise of the application identities. The precise mechanism by which the credentials were exposed is currently the subject of rigorous ongoing investigation by ConnectWise security personnel and external partners.

The nature of this cyberattack makes it exceptionally dangerous for enterprise environments. Rather than requiring attackers to steal individual user passwords one by one, the breach exploits trusted application credentials to gain administrative entry into customer Microsoft 365 environments. By using the compromised application credentials to authenticate as the legitimate application itself, threat actors can request valid access tokens from Microsoft Entra ID based entirely on the application’s pre-existing, elevated permissions.

Depending on the specific scopes and permissions assigned to these applications during normal operations, unauthorized access can potentially extend across a wide array of Microsoft services. This includes sensitive corporate mailboxes, SharePoint document repositories, Teams messages, and comprehensive directory information. Because ConnectWise applications traditionally operate with extensive privileges necessary to perform complex system backups and routine management tasks, the theft of these credentials grants malicious actors the ability to expand their footprint rapidly. Attackers can leverage this access to add the application to the Global Administrator role, inject fresh client secrets into other trusted applications within the tenant, and spawn entirely new applications equipped with broad administrative permissions.

The establishment of persistence through newly added client secrets creates a secondary threat vector. Even if the original compromised vendor credential is quickly discovered and revoked, these hidden client secrets allow attackers to continue authenticating as trusted applications, ensuring they maintain a permanent foothold in the compromised environment.

Second, Targeted Wave of Attempts Observed

As the investigation deepened, external security researchers began uncovering troubling details regarding the scale and persistence of the campaign. Jon Semon, Principal Security Operations Analyst at managed security service provider Huntress, shared critical insights regarding the timeline and methodology of the threat actors with industry outlets.

According to Huntress telemetry, malicious sign-ins originating from the primary attacker IP address were last observed on October 15 at 08:45 UTC, with targeted, highly manual activity continuing until approximately 14:20 UTC that same day. While ConnectWise’s rapid shutdown of the Cloud Backup service should have effectively halted activity tied to that specific vector, analysts warned that if the attackers successfully injected new credentials into applications within individual Microsoft tenants prior to the cutoff, those credentials would enable them to retain access by acting directly as the application.

Huntress confirmed that while it had not identified widespread new malicious activity immediately following the weekend interventions, there was no indication that the cessation of attacks was driven by public disclosure of the incident. More alarmingly, as of late Saturday, Huntress researchers identified a distinct, second wave of targeted attempts originating from the same infrastructure, specifically utilizing the IP address 144.172.64[.]128 on October 15. These subsequent efforts were highly focused, singling out a narrow scope of 16 high-value tenants operating within critical sectors such as policy, national security, trade, and critical minerals.

Detailing the mechanics of this second wave, Huntress reported that the initial sweep targeted Graph tokens harvested from the SkyKick application between 09:25:04 and 12:35:50 UTC. A second, closely coordinated sweep hit the exact same set of targeted tenants later that afternoon, between 13:54:39 and 14:20:24 UTC. This secondary phase exhibited clear characteristics of manual operation, systematically targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.

In total, Huntress has identified nearly 1,000 Entra tenants exhibiting sign-in activity linked to the IP address associated with the unauthorized actions, out of which approximately 300 sign-in attempts were technically successful. In some of these successful instances, however, the absence of a configured service principal within the specific tenant successfully blocked the threat actor from achieving full operational access.

Security analysts emphasize that organizations utilizing integrated cloud ecosystems must leverage advanced identity and access management controls to mitigate the systemic risks posed by compromised third-party application credentials. Experts point out that proper Microsoft Entra configuration controls can drastically limit the potential blast radius if a vendor application credential is ever stolen or abused. Application management policies, for instance, can be configured to restrict or outright block client secrets on app registrations while capping credential lifetimes to reduce exposure windows. Furthermore, tightly controlling who holds high-level directory privileges, such as the Application Administrator and Cloud Application Administrator roles, significantly minimizes the pool of users capable of provisioning new credentials to existing applications.

Additional safeguards, such as implementing Conditional Access policies specifically tailored for workload identities, can successfully restrict the geographic and network locations from which an application is authorized to initiate sign-in requests. While these advanced defenses require appropriate licensing tiers and do not serve as a direct substitute for routine credential audits and hygiene, security professionals stress that they make embedded malicious secrets substantially harder to operationalize and much easier for internal monitoring tools to detect. As ConnectWise and the broader cybersecurity community continue their collaborative forensic analysis, affected partners and organizations are strongly urged to review their tenant logs, audit active service principals, and apply rigorous security hardening across all integrated cloud applications.