IT management software provider ConnectWise has announced the disabling of seven application identities as part of an ongoing security investigation. The intervention follows an incident in which unknown threat actors gained unauthorized access to application identities, subsequently compromising Microsoft 365 tenants across multiple organizations.
The security event, which has triggered widespread concern across the managed service provider (MSP) ecosystem, prompted ConnectWise to take swift administrative action. According to the company, the decisive mitigations were enacted on October 17, 2026, at 07:00 UTC. Alongside disabling the compromised application identities, the software provider suspended its Cloud Backup service by revoking the certificates utilized for affected application connections across its user base.
The unauthorized access allows threat actors to leverage application credentials to infiltrate customer Microsoft 365 environments without needing to acquire individual user passwords. By authenticating as the application itself, attackers can request access tokens from Microsoft Entra ID based on the pre-existing privileges granted to the application. Depending on the scope of those permissions, intruders could potentially gain access to a wide array of Microsoft services, including corporate mailboxes, SharePoint documents, Teams messages, and sensitive directory information.
Because ConnectWise applications typically operate with extensive permissions required to perform complex backup and management operations, the theft of these credentials grants malicious actors substantial leverage. Threat actors can abuse this level of access to expand their footprint, potentially adding the application to the Global Administrator role, injecting client secrets into other trusted applications within the tenant, and provisioning entirely new applications with elevated permissions. These client secrets provide an alternative authentication mechanism, allowing attackers to establish persistence and retain access to compromised environments even if the original compromised credentials are eventually revoked.
In addressing the scope of the incident, ConnectWise clarified that disabling affected connections successfully blocks new authentications through those pathways, though it cannot automatically reverse modifications previously executed inside an affected tenant. Furthermore, the company noted that shared Cloud Backup credentials have been invalidated, and while previously issued access tokens may remain functional until they naturally expire or are explicitly invalidated, any extraneous credentials or unauthorized permissions established through separate identities demand comprehensive independent review and remediation.
ConnectWise also addressed the operational impact on its Cloud Backup service, confirming that scheduled backups are currently non-functional and that access to impacted backup archives and restoration tools remains temporarily offline. However, the company emphasized that existing backup archives remain fully encrypted, isolated, and preserved. Thorough internal reviews have yielded no evidence indicating that these archives were breached or accessed by the malicious actors.
Out of an abundance of caution, the software vendor temporarily took its SaaS Security and Cloud Management platforms offline to complete a rigorous review of the incident. The underlying issue was initially detected on October 14, 2026, via internal advanced cybersecurity monitoring and diligence protocols, which immediately triggered comprehensive internal and external incident response procedures.
ConnectWise reported that since deploying these mitigations, no further successful threat activity has been observed within the environments directly monitored by the company. Nevertheless, the firm noted that this observation does not establish the security status of downstream customer environments, which, by design, cannot be directly observed by the vendor. At this stage of the investigation, it remains undetermined whether a specific product vulnerability facilitated the initial compromise of the application identities, and the precise credential-exposure mechanism is currently the subject of rigorous ongoing analysis.
Second, Targeted Wave of Attempts Observed
Independent cybersecurity research firms have been closely tracking the incident and providing critical visibility into the tactics employed by the threat actors. Jon Semon, Principal Security Operations Analyst at cybersecurity firm Huntress, shared operational insights regarding the timeline and mechanics of the attack.
According to Huntress, malicious sign-ins originating from the primary attacker address were last observed on October 15 at 08:45 UTC, with targeted, manual activity persisting until approximately 14:20 UTC that same day. While ConnectWise’s suspension of the Cloud Backup service should have curtailed activity associated with that specific vector, analysts warned that if threat actors successfully added persistent credentials to applications within Microsoft tenants prior to the mitigation, those alternative credentials would allow them to maintain unauthorized access.
Huntress confirmed that it has not identified new malicious activity originating from the primary vectors since October 15, though it emphasized there is no indication that the sudden cessation was driven by public disclosure of the security incident. Analysts expressed high confidence that the threat actor also deliberately targeted ConnectWise Cloud Management applications tailored for Exchange Online, Microsoft Teams, and SharePoint, confirming actual abuse of the Teams application within at least one customer tenant. Because those specific applications were not initially disabled by ConnectWise at the same scale as the backup infrastructure, security researchers have maintained active investigations into potential residual vectors.
Late Saturday disclosures from Huntress revealed a second, distinct wave of targeted intrusion attempts originating from a specific IP address, 144.172.64[.]128, which was active on October 15. These focused efforts singled out a narrow, high-value scope of 16 tenants operating primarily within the policy, national security, trade, and critical mineral sectors. Fortunately, these secondary attempts proved unsuccessful.
Detailed technical analysis indicates that for this new target set, the initial sweep targeted Graph tokens from the SkyKick application between 09:25:04 and 12:35:50 UTC. A subsequent sweep targeted the exact same tenants later that day between 13:54:39 and 14:20:24 UTC. This second wave appeared to be manual in nature, directly targeting Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.
Across all observed telemetry, the managed security service provider has identified nearly 1,000 Entra tenants displaying sign-in activity associated with the suspicious IP address, out of which roughly 300 sign-ins succeeded. Despite the successful authentication attempts in a portion of those environments, security analysts noted that the absence of an active service principal in certain targeted tenants effectively blocked the threat actor from achieving meaningful post-compromise access.
Security experts continue to emphasize the importance of robust identity and access management configurations to mitigate the broader fallout of vendor credential thefts. Industry guidance highlights that several built-in Microsoft Entra controls can significantly limit potential damage if an application credential is compromised. Application management policies can be configured to restrict or completely block client secrets on app registrations while capping credential lifetimes. Furthermore, restricting the assignment of high-privileged roles such as Application Administrator and Cloud Application Administrator reduces the number of users capable of provisioning new credentials to enterprise applications.
While advanced mitigations like Conditional Access for workload identities require additional licensing, they offer crucial capabilities to restrict the geographic or network locations from which an application is permitted to authenticate. Additionally, Microsoft Entra ID Protection can automatically flag risky service principals. Cybersecurity analysts note that while none of these preventative controls serve as a complete replacement for rigorous credential auditing and routine monitoring, they collectively make planted secrets significantly harder to operationalize and much easier for security teams to detect during incident response procedures.
