IT management software provider ConnectWise has announced the disabling of seven application identities as it continues a thorough and ongoing investigation into a security incident. The breach involved unknown threat actors successfully obtaining unauthorized access to these application identities, which were subsequently exploited to compromise Microsoft 365 tenants across various organizations.
The security crisis came to light after the company’s advanced monitoring systems detected suspicious activity, triggering immediate incident response protocols. According to ConnectWise, the decision to disable the affected identities was implemented on October 17, 2026, at 07:00 UTC. Simultaneously, the company suspended its Cloud Backup service by actively revoking the specific certificates used for affected application connections across all user environments.
Explaining the scope and limitations of these immediate mitigations, ConnectWise noted that disabling the compromised connections successfully prevents any new authentication attempts through those specific pathways. However, the company cautioned that taking these steps does not automatically reverse changes or configurations previously made inside an already compromised tenant by malicious actors.
Furthermore, ConnectWise clarified that the affected shared Cloud Backup credentials are now entirely invalid. Despite this, previously issued access tokens may still remain usable until they naturally expire or are otherwise actively invalidated by administrators. The company emphasized that any unauthorized credentials, permissions, or alternative avenues of access established through separate identities require additional, manual review and comprehensive remediation by affected clients and partners.
The disruption has temporarily impacted standard operations, with ConnectWise confirming that scheduled backups are currently not running. Additionally, immediate access to affected backup archives and restoration capabilities remains unavailable while the investigation proceeds. Despite this operational pause, the company reassured stakeholders that existing backup archives remain fully encrypted, isolated, and safely preserved. ConnectWise stated there is currently no evidence to suggest that these archives were breached, downloaded, or otherwise accessed by the attackers.
Out of an abundance of caution, the software provider has also temporarily taken its SaaS Security and Cloud Management offerings offline. This proactive measure will remain in place while technical teams complete their comprehensive review of the security incident and ensure the integrity of the platforms.
The underlying issue was first identified by ConnectWise on October 14, 2026, through internal advanced cybersecurity monitoring and vigilance. This discovery prompted the immediate activation of both internal and external incident investigation and response teams to contain the threat and assess the damage.
Since implementing these initial mitigations, ConnectWise reports that it has not observed any further successful threat activity within the environments directly monitored by the company. However, the organization pointed out that this finding does not establish the security status of downstream customer environments, which operate independently and, by design, cannot be directly observed or managed by the vendor.
At this stage of the investigation, it remains unclear whether a specific product vulnerability contributed to the initial compromise of the application identities. The exact mechanism through which the credentials were exposed is currently the subject of an ongoing, detailed technical analysis by security experts.
The nature of this attack makes it particularly dangerous within modern enterprise ecosystems. The breach allows threat actors to abuse trusted application credentials to gain access to customer Microsoft 365 environments without needing to steal individual user passwords. By utilizing the stolen application credentials to authenticate directly as the application itself, malicious actors can request valid access tokens from Microsoft Entra ID, relying entirely on the application’s pre-existing permissions and trust relationships.
Depending on the specific permissions assigned to the application, this unauthorized entry point could potentially enable attackers to navigate and harvest data across a wide range of Microsoft services. This includes corporate mailboxes, sensitive SharePoint documents, Microsoft Teams messages, and comprehensive directory information.
Because ConnectWise applications frequently operate with extensive administrative privileges to perform routine system backups and complex management tasks, the theft of these credentials grants significant leverage. Threat actors can authenticate as the application to expand their footprint, such as elevating privileges by adding the identity to the Global Administrator role, injecting malicious client secrets into other trusted applications within the tenant, or creating entirely new rogue applications equipped with broad permissions.
The generation of these unauthorized client secrets provides a persistent back-door mechanism. It allows the threat actor to continue authenticating as the application and maintain a persistent foothold, ensuring alternative means to regain entry into a compromised environment even if the original compromised credential is subsequently revoked or disabled.
Second, Targeted Wave of Attempts Observed
Independent security researchers and managed security service providers have been tracking the fallout closely. Jon Semon, Principal Security Operations Analyst at Huntress, shared critical observations regarding the timeline and behavior of the threat actors involved in the campaign.
According to Huntress, malicious sign-ins originating from the primary attacker address were last logged on October 15 at 08:45 UTC, with targeted, manual activity continuing until approximately 14:20 UTC that same day. Semon noted that while ConnectWise stated access to Cloud Backup was shut off, potentially halting activity through that specific vector, lingering risks remain if threat actors successfully added custom credentials to other applications within Microsoft tenants during their initial window of access.
Huntress confirmed that while it has not identified broad new malicious activity since October 15, there is no indication that the sudden halt in activity was caused by public disclosure of the incident. Furthermore, researchers expressed high confidence that the threat actor specifically targeted ConnectWise Cloud Management applications designed for Exchange Online, Microsoft Teams, and SharePoint. Security analysts have already confirmed the active abuse of the Microsoft Teams application within at least one customer tenant. Because these specific management apps did not appear to have been immediately disabled by ConnectWise during the initial hours, researchers warn that additional activity could potentially stem from them, prompting ongoing, active monitoring.
As of late Saturday, Huntress revealed it had identified a distinct, second wave of targeted attempts originating from a specific IP address on October 15. These focused efforts singled out a narrow, highly sensitive scope of 16 distinct tenants operating primarily within the policy, national security, trade, and critical mineral sectors, though these secondary attempts were ultimately unsuccessful.
During this targeted phase, the first sweep focused on acquiring Graph tokens from the SkyKick application between 09:25:04 and 12:35:50 UTC. A subsequent sweep hit the exact same set of tenants later that afternoon, between 13:54:39 and 14:20:24 UTC. Analysts noted that this second sweep appeared to be manual and deliberately targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.
In total, the managed security service provider has identified nearly 1,000 Entra tenants that experienced sign-in activity originating from the IP address linked to the unauthorized operations. Out of those, approximately 300 sign-in attempts were technically successful. However, researchers noted that the absence of a required service principal in some of those specific tenants successfully prevented the threat actor from executing further unauthorized access.
Security experts emphasize that organizations can implement several native Microsoft Entra controls to significantly limit potential damage if an application credential is ever compromised in the future. Effective strategies include establishing strict application management policies that restrict or completely block client secrets on app registrations, as well as capping maximum credential lifetimes to reduce exposure windows.
Additionally, limiting the number of individuals who hold powerful administrative roles, such as Application Administrator and Cloud Application Administrator, reduces the risk of unauthorized personnel adding rogue credentials to existing applications. Implementing Conditional Access policies for workload identities—which often require additional licensing tiers—can successfully restrict the geographic locations or networks from which an application is permitted to sign in. Furthermore, Microsoft Entra ID Protection can actively flag risky service principals exhibiting anomalous behavior. While none of these defensive measures serve as a complete replacement for rigorous credential reviews and hygiene, security professionals note they make planted secrets significantly harder to exploit and much easier to detect during routine audits.
