ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants.
The disabled identities are listed below -
- ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management - 2399d300-6fca-4e6a-a686-399fefe75b83
- ConnectWise Cloud Management - MS Teams - 24205314-2b89-4e07-a2a4-579e898a5640
- ConnectWise Cloud Management - Exchange Online - b78f6a77-d4e5-46fb-87e5-d1648bd02519
- ConnectWise Cloud Management - MS Graph - 0de14c77-b9b0-4137-9360-34878a929827
- ConnectWise Cloud Management - Partner Center - 412dcf96-176d-4b3a-a1b0-4981ad66971e
- ConnectWise Cloud Management - SharePoint Online - b2b55f5b-7758-4719-8d8f-88ae172e6bdb
The IT management software provider said it took the action on October 17, 2026, at 07:00 UTC, adding it has also suspended Cloud Backup service by revoking certificates used for affected application connections across all users.
"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," it said.
"The affected shared Cloud Backup credentials are no longer valid. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation."
ConnectWise also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.
Out of an abundance of caution, the company said it has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident.
Furthermore, the company revealed that it identified the issue on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting it to activate internal and external incident investigation and response actions.
"Since implementing these mitigations, we have not observed successful threat activity in the environments we monitor," it said. "This finding does not establish the status of downstream customer environments, which, by design, we cannot directly observe."
At this stage, it's unclear if a product vulnerability contributed to the compromise of the application identities. The exact credential-exposure mechanism is the subject of an ongoing analysis, ConnectWise added.
The attack is particularly dangerous as it allows an attacker to abuse the application's credentials to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions.
Depending on the permissions assigned to the application, this could enable the attacker to potentially access other Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information.
With ConnectWise's applications operating with extensive permissions to perform backups and management tasks, the theft of the credential allows the threat actor to authenticate as the application itself and expand their access by adding it to the Global Administrator role, adding client secrets to other trusted applications in the tenant, and creating new applications and granting them permissions.
By doing so, the client secrets offer a way to authenticate as that application and establish persistence, providing an alternative means to regain access to the compromised environment even if the original compromised credential is later revoked.
Second, Targeted Wave of Attempts Observed
"We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day," Jon Semon, Principal Security Operations Analyst at Huntress, told The Hacker News.
"ConnectWise has said access to Cloud Backup is shut off, and if so, activity through that service should have stopped. However, if the threat actor was able to add credentials to applications in Microsoft tenants, those credentials would let them keep access and act as the application."
Huntress said it has not identified new malicious activity since October 15, but there is no evidence that the stoppage was the result of public disclosure.
"We have high confidence the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and we have confirmed abuse of the Teams app in one tenant," Semon said. "Those apps do not appear to have been disabled by ConnectWise, so additional activity could come from them, and we are actively investigating."
As of late Saturday, Huntress said it identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15. These efforts, which singled out a narrow scope of 16 tenants, were unsuccessful. The tenants are in the policy, national security, trade, and critical mineral sectors.
"For the new target set, the first sweep targeted Graph tokens from the SkyKick app and occurred on October 15 between 09:25:04 and 12:35:50 UTC," Huntress said. "The second sweep hit the same tenants on the same date, between 13:54:39 and 14:20:24 UTC. This sweep appeared to be manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs."
In all, the managed security service provider has identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity from the IP address in question, out of which 300 succeeded. Despite the successful sign-in, the absence of a service principal in some tenants is said to have prevented the threat actor from gaining access to those tenants.
Partners are advised to take the following actions -
- Review both their own Microsoft 365 tenant and each managed customer tenant, including environments with dormant SkyKick connections.
- Verify the status of the listed application connections and keep affected applications disabled until further notice.
- Review sign-ins across identities from October 13, 2026, through the current time, specifically for activity originating from the IP address "144.172.64[.]128."
- Preserve available sign-in and audit records before initiating containment steps.
- Review application and user authentication, application credentials and federation trusts, directory roles, owners, consent grants, and recent policy changes.
- Check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
- Investigate any other identities changed or used during suspicious activity.
"Several Entra controls limit the damage if an application credential is stolen," Huntress said. "Application management policies can restrict or block client secrets on app registrations and cap credential lifetimes. Limiting who holds the Application Administrator and Cloud Application Administrator roles reduces who can add credentials to applications."
"Conditional Access for workload identities, which needs additional licensing, can restrict where an application is allowed to sign in from, and Microsoft Entra ID Protection can flag risky service principals. None of these replace reviewing credentials, but they make a planted secret harder to use or easier to spot."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.