ConnectWise announced Saturday that it has disabled seven ConnectWise app identities as it continues to investigate an incident in which unknown threat actors gained unauthorized access to app identities and compromised Microsoft 365 tenants.
Disabled identities are listed below –
- ConnectWise Cloud Backup – 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management – 2399d300-6fca-4e6a-a686-399fefe75b83
- ConnectWise Cloud Management – MS Teams – 24205314-2b89-4e07-a2a4-579e898a5640
- ConnectWise Cloud Management – Exchange Online – b78f6a77-d4e5-46fb-87e5-d1648bd02519
- ConnectWise Cloud Management – MS Graph – 0de14c77-b9b0-4137-9360-34878a929827
- ConnectWise Cloud Management – Partner Center – 412dcf96-176d-4b3a-a1b0-4981ad66971e
- ConnectWise Cloud Management – SharePoint Online – b2b55f5b-7758-4719-8d8f-88ae172e6bdb
The IT management software provider said it took this action on October 17, 2026 at 07:00 UTC, adding that it also suspended the Cloud Backup service by revoking certificates used for affected application connections for all users.
“Disabling affected logins prevents re-authentication through those logins; it does not undo changes previously made within a tenant,” it says.
“Impacted shared cloud backup credentials are no longer valid. Previously issued access tokens may remain usable until expired or invalidated. Any credentials, authorizations, or other unauthorized access established via separate identities require additional review and remediation.”
ConnectWise also noted that scheduled backups are not running and access to affected backup archives and restore capabilities remains unavailable. However, he stressed that existing archives remain encrypted, isolated and preserved, and that there is no evidence that they have been breached or accessed by the attackers.
Out of an abundance of caution, the company said it has temporarily taken SaaS security and cloud management offline while it completes its review of the incident.
Additionally, the company revealed that it identified the issue on October 14, 2026, through its “advanced cybersecurity monitoring and diligence,” prompting it to activate internal and external incident response investigations and actions.
“Since implementing these mitigation measures, we have not observed any successful threat activity in the environments we monitor,” he said. “This finding does not establish the status of downstream customer environments, which, by design, we cannot observe directly.”
At this point, it is unclear whether a product vulnerability contributed to the compromise of application identities. The exact mechanism of credential exposure is under ongoing analysis, ConnectWise added.
The attack is particularly dangerous because it allows an attacker to misuse application credentials to gain access to customers’ Microsoft 365 environments without having to steal each customer’s password individually. Using the stolen application credentials to authenticate as an application, the attacker can request access tokens from Microsoft Entra ID based on the application’s existing permissions.
Depending on the permissions assigned to the application, this could allow the attacker to potentially access other Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information.
Because ConnectWise applications operate with broad permissions to perform backups and management tasks, stealing credentials allows the threat actor to authenticate as the application itself and extend its access by adding it to the global administrator role, adding client secrets to other approved applications in the tenant, creating new applications, and granting them permissions.
In doing so, client secrets provide a means to authenticate as an application and establish persistence, thereby providing an alternative means of regaining access to the compromised environment even if the original compromised credentials are later revoked.
Second, a wave of targeted attempts observed
“We last observed malicious connections from the originating address on October 15 at 08:45 UTC, with targeted manual activity continuing until approximately 14:20 UTC that day,” Jon Semon, senior security operations analyst at Huntress, told The Hacker News.
“ConnectWise stated that access to Cloud Backup was closed and, if that were the case, activity through that service should have stopped. However, if the threat actor was able to add credentials to Microsoft tenant applications, those credentials would allow them to maintain access and act as the application.”
Huntress said it has not identified any new malicious activity since October 15, but there is no evidence that the shutdown was the result of public disclosure.
“We are confident that the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and we have confirmed abuse of the Teams app at one tenant,” Semon said. “These apps do not appear to have been disabled by ConnectWise, so additional activity could be coming from this, and we are actively investigating.”
On Saturday evening, Huntress said it identified a “second wave of targeted attempts” from the IP address “144.172.64(.)128” on October 15. These efforts, which targeted a restricted area of 16 tenants, were unsuccessful. Tenants are from the politics, national security, commerce and critical minerals sectors.
“For the new set of goals, the first sweep targeted SkyKick app Graph tokens and took place on October 15 between 09:25:04 and 12:35:50 UTC,” Huntress said. “The second scan hit the same tenants on the same date, between 1:54:39 PM and 2:20:24 PM UTC. This scan appeared to be manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 management APIs.”
In total, the managed security services provider identified nearly 1,000 Entra tenants with login activity from the IP address associated with unauthorized activity from the IP address in question, of which 300 were successful. Despite a successful connection, the lack of a service principal for some tenants would have prevented the threat actor from accessing those tenants.
Partners are advised to take the following actions:
- Review both their own Microsoft 365 tenant and each managed tenant, including environments with inactive SkyKick connections.
- Check the connection status of the listed applications and keep the affected applications disabled until further notice.
- Review logins for all identities from October 13, 2026 to present, especially for activity originating from the IP address “144.172.64(.)128”.
- Keep connection and audit records available before initiating containment steps.
- Review application and user authentication, application credentials and federation trusts, directory roles, owners, permissions granted, and recent policy changes.
- Check for unauthorized mailbox transfers, inbox or transport rules, and delegated access to mailboxes.
- Investigate any other identities changed or used in suspicious activity.
“Several Entra controls limit the damage if an application ID is stolen,” Huntress said. “Application management policies can restrict or block client secrets during application registrations and limit the lifetime of credentials. Limiting the Application Administrator and Cloud Application Administrator roles reduces the number of people who can add credentials to applications.”
“Conditional access for workload identities, which requires additional licenses, can restrict where an application is allowed to connect from, and Microsoft Entra ID Protection can flag service principals at risk. None of these replace credential review, but they do make an implanted secret harder to use or easier to spot.
Gn tech
