ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m. UTC, three days after the incident was first identified -
- Disabling affected application connections and suspending Cloud Backup.
- Suspending SaaS Security and Cloud Management as a precaution because they are integrated with Cloud Backup.
- Enlisting the help of independent third-party specialists for incident response and remediation.
- Enhancing administrative-access protections.
- Publishing technical guidance to help partners investigate and remediate potential unauthorized activity in their own and managed customer environments.
ConnectWise said it's validating the effectiveness of its containment measures and emphasized that it has not seen any successful threat activity in the environments it monitors. There is no evidence that any ConnectWise products and services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.
"This observation does not establish whether individual partner or customer Microsoft 365 tenants have been affected," it said. "Reviewing each potentially affected tenant remains essential."
"Before making changes, preserve relevant evidence, validate findings, and assess potential operational impacts. Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated. Do not reconnect affected applications until ConnectWise provides formal restoration instructions."
Huntress has shared the following IP addresses observed in connection with the activity, adding that the password spray and failed login attempts linked to some of them are unlikely to be related to the application sign-in activity -
- 144.172.64[.]128 - Application sign-ins with a vendor credential (primary vector)
- 144.172.64[.]99 - Failed user password spray, concentrated (October 10 to 14, 2026)
- 144.172.64[.]60 - A few failed user logins (October 18, 2026)
- 144.172.94[.]243 - Broad failed login spray, ongoing against many organizations
"In a review of application sign-ins across more than 10,000 tenants with ConnectWise applications (where we can see those logs), 144.172.64[.]128 and Microsoft-internal ranges are the only addresses that produced application sign-in activity," Huntress researchers said in an update.
"We did not see application sign-in activity from any of the other addresses listed below, all of which are in the same provider range as 144.172.64[.]128 (AS14956, RouterHosting). We did see password spray and failed login attempts from some of them."
The cybersecurity company said it also observed post-compromise actions on a second tenant, following the same modus operandi as before, in which the application granted itself Global Administrator and then added a new secret on a small number of other applications in the tenant for persistence.
While the access may have been used for Microsoft Graph directory reads, there are no signs the attackers weaponized it for mailbox or file manipulation, or to make user or policy changes.
"The choice of which applications to backdoor appeared to be random in the two tenants we reviewed," Huntress added. "Across the two compromised tenants, the identical grant flow selected two completely different sets of applications. The only consistent criteria we can point to is structural: credentials were planted in applications that are registered inside the affected tenant, without regard to what those applications can actually do."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.