ConnectWise Disables Compromised Application Identities Following Microsoft 365 Tenant Breaches

IT management software provider ConnectWise has confirmed the disabling of seven application identities as part of an ongoing, high-stakes security investigation. The emergency response follows an incident in which unknown threat actors gained unauthorized access to application credentials, subsequently using them to compromise Microsoft 365 customer tenants. The unfolding situation has sent ripples through the managed service provider community, prompting leading cybersecurity firms to sound the alarm and uncover a secondary, targeted wave of malicious activity.

The company announced that it executed the protective measures on October 17, 2026, at 07:00 UTC. Alongside the neutralization of the seven targeted application identities, ConnectWise suspended its Cloud Backup service by actively revoking the certificates utilized for affected application connections across all user environments. According to the software provider, disabling these vulnerable connections successfully blocks any new authentication attempts through those specific pathways, though it acknowledged a critical limitation: the action does not automatically reverse changes or configurations previously manipulated inside a compromised tenant.

Elaborating on the technical fallout, ConnectWise stated that the affected shared Cloud Backup credentials are now entirely invalid. However, the company warned that previously issued access tokens might remain operational until they naturally expire or are explicitly invalidated. Furthermore, the firm emphasized that any unauthorized credentials, permissions, or alternative avenues of access established by the attackers through separate identities necessitate deep, manual review and comprehensive remediation by system administrators.

The disruption has temporarily impacted standard operations, with scheduled backups currently halted and access to affected backup archives and restoration capabilities temporarily offline. Despite these operational hurdles, ConnectWise offered reassurance regarding the integrity of existing data, emphasizing that all current archives remain encrypted, isolated, and safely preserved. The company reported seeing no evidence that these archives were breached or accessed directly by the threat actors. Out of an abundance of caution, ConnectWise also took its SaaS Security and Cloud Management tools offline while completing a exhaustive review of the security breach.

The timeline of the discovery dates back to October 14, 2026, when ConnectWise first identified the anomaly through its advanced cybersecurity monitoring and diligence frameworks. This discovery immediately triggered both internal and external incident response protocols. In a subsequent update, the software provider noted that since putting these mitigations into place, its monitoring systems have not observed any successful threat activity in the environments under its direct observation. However, the company qualified this statement by noting that it cannot directly view downstream customer environments by design, leaving the exact status of individual client tenants dependent on local administrative review.

At this stage in the analysis, the root cause of the incident remains under investigation. ConnectWise stated that it is still unclear whether a specific product vulnerability contributed to the initial compromise of the application identities, with the exact credential-exposure mechanism remaining the primary subject of ongoing technical analysis.

The architectural nature of the attack makes it exceptionally dangerous. The exploit enables threat actors to leverage stolen application credentials to access customer Microsoft 365 environments directly, bypassing the need to steal individual user passwords. By authenticating as the application itself, attackers can request access tokens from Microsoft Entra ID that are backed by the application’s pre-existing permissions. Depending on the scope of privileges assigned to the tool, this unauthorized access can potentially extend across a wide array of Microsoft services, including corporate mailboxes, SharePoint documents, Microsoft Teams messages, and sensitive directory information.

Because ConnectWise applications typically operate with extensive administrative permissions required to perform complex backup and management operations, the theft of these credentials grants malicious actors a powerful foothold. Attackers can exploit this position to expand their footprint by promoting the application to the Global Administrator role, injecting client secrets into other trusted applications within the tenant, and provisioning entirely new applications with broad privileges. These newly generated client secrets provide a reliable secondary method for authenticating as the application, ensuring long-term persistence that allows attackers to maintain access even if the original compromised credentials are later revoked.

Second, Targeted Wave of Attempts Observed

The breadth of the campaign has become increasingly clear through independent tracking by managed security service providers. Jon Semon, Principal Security Operations Analyst at Huntress, shared critical observations regarding the threat group’s operational timeline and methodology.

"We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day," Semon stated. While ConnectWise’s decision to shut off access to Cloud Backup should have effectively choked off service-related activity, Semon pointed out a lingering danger. If the threat actor successfully injected new credentials into applications within Microsoft tenants prior to the shutdown, those lingering credentials would grant them ongoing access to act independently as the application.

Huntress confirmed that while it has not identified brand-new malicious activity since October 15, there is no indication that the sudden halt in activity was prompted by public disclosure or defensive awareness. Furthermore, the security firm expressed high confidence that the threat actors also specifically targeted ConnectWise Cloud Management applications tailored for Exchange Online, Microsoft Teams, and SharePoint, confirming actual abuse of the Teams integration within at least one customer tenant. Because those specific applications were not initially disabled by ConnectWise at the same rate, security analysts remain on high alert for lingering or renewed exploitation.

Late Saturday updates from Huntress revealed a distinct, highly targeted second wave of attempts originating from a specific IP address on October 15. These manual efforts focused narrowly on a select group of 16 high-value tenants operating primarily within the policy, national security, trade, and critical mineral sectors, though these secondary attempts ultimately proved unsuccessful.

During this targeted sweep, the attackers first pursued Graph tokens from the SkyKick application during a morning window, followed by a manual afternoon sweep targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs. Across the entire campaign, Huntress identified nearly 1,000 Entra tenants exhibiting sign-in activity linked to the suspect IP address, resulting in approximately 300 successful authentications. In some instances where sign-ins succeeded, the absence of a service principal successfully prevented the threat actor from achieving full operational access to the tenant.

Security experts emphasize that administrators can leverage specific Microsoft Entra controls to mitigate potential damage in the event of an application credential compromise. Application management policies can be configured to restrict or completely block client secrets on app registrations, as well as enforce strict caps on credential lifetimes. Furthermore, tightly controlling the assignment of Application Administrator and Cloud Application Administrator roles reduces the pool of users capable of attaching new credentials to existing applications.

Additional defenses, such as Conditional Access policies tailored for workload identities and Microsoft Entra ID Protection, offer mechanisms to flag risky service principals and restrict geographic or network locations from which an application is permitted to sign in. While these controls do not replace the critical need for proactive credential reviews and environment hygiene, security professionals note they significantly raise the barrier to entry, making planted secrets much harder to exploit and much easier to detect.