IT management software provider ConnectWise has confirmed it disabled seven of its application identities after discovering that unknown threat actors obtained unauthorized access to them, leading to downstream compromises of Microsoft 365 tenants. The emergency actions, which included widespread service suspensions and certificate revocations, mark a critical escalation in an ongoing cybersecurity incident first uncovered earlier in the week.
The company announced that the security measures were enacted at 07:00 UTC, following a multi-day internal and external investigation into how malicious actors managed to target and exploit shared application credentials. Alongside the shutdown of the specific application identities, ConnectWise suspended its Cloud Backup service by revoking certificates used for affected application connections across all user environments.
According to ConnectWise, disabling the affected connections immediately halts any new authentication requests through those specific channels. However, the software provider clarified that this emergency mitigation does not automatically reverse or undo changes or malicious alterations previously executed inside a compromised customer tenant. Furthermore, the shared Cloud Backup credentials are now permanently invalid, though previously issued access tokens may theoretically remain operational until they naturally expire or are explicitly invalidated by administrators. The company warned that any unauthorized credentials, permission modifications, or alternative access vectors established through separate identities still require exhaustive manual review and targeted remediation.
The disruption has temporarily impacted standard operations, with scheduled backups currently stalled and direct access to affected backup archives and restoration capabilities temporarily unavailable. Despite this operational pause, ConnectWise emphasized that all existing backup archives remain fully encrypted, isolated, and preserved. Preliminary assessments indicate no evidence suggesting that the underlying archives were breached, exfiltrated, or accessed by the attackers during the intrusion.
Out of an abundance of caution while remediation efforts continue, ConnectWise also temporarily took its SaaS Security and Cloud Management tools offline while completing a comprehensive review of the incident’s full scope.
The security incident first came to light on October 14, when ConnectWise identified anomalous activity through its advanced cybersecurity monitoring and diligence frameworks. This discovery immediately triggered the activation of comprehensive internal and external incident response protocols. In updates regarding ongoing telemetry, the company stated that since deploying these mitigations, it has not observed successful threat activity within the environments under its direct monitoring. At the same time, ConnectWise acknowledged that this finding does not provide visibility into the status of downstream customer environments, which, by design, are outside its direct line of sight.
Security analysts and industry observers note that the attack is exceptionally dangerous because it allows malicious actors to abuse trusted application credentials to access customer Microsoft 365 environments without needing to steal individual user passwords. By leveraging stolen application credentials to authenticate as the legitimate application itself, threat actors can request legitimate access tokens from Microsoft Entra ID based entirely on the application’s pre-existing, elevated permissions. Depending on the precise administrative privileges assigned to the application, this capability can grant attackers deep entry into a wide range of interconnected Microsoft services, including corporate mailboxes, SharePoint document repositories, Microsoft Teams messages, and sensitive directory information.
Because IT management and backup applications typically operate with extensive permissions to execute routine maintenance and administrative tasks, the theft of these foundational credentials offers a powerful springboard. Attackers can authenticate as the application itself, systematically expand their footprint, assign applications to the powerful Global Administrator role, append new client secrets to other trusted applications within the tenant, and spin up entirely new applications equipped with custom permissions. These newly generated client secrets establish enduring persistence, granting threat actors an alternative means to regain access to a compromised corporate environment even if the original, primary compromised credential is subsequently revoked or disabled.
Second, Targeted Wave of Attempts Observed
Security researchers tracking the incident have uncovered further details concerning the operational tactics of the threat actors. Jon Semon, Principal Security Operations Analyst at Huntress, shared insights into the timeline of malicious activity observed across the wider managed service provider ecosystem.
According to Huntress telemetry, malicious sign-in attempts originating from the primary suspicious IP address were last logged, with targeted manual activity continuing until mid-afternoon on that day. While ConnectWise’s emergency shutdown of Cloud Backup services should have effectively choked off activity reliant on that specific vector, researchers noted that if the threat actor successfully injected new credentials into applications within Microsoft tenants prior to the cutoff, those lingering credentials could still permit unauthorized access and allow the attacker to masquerade as the application.
Huntress reported that it has not identified broad new malicious activity linked to the initial wave, though researchers cautioned there is no evidence that the abrupt cessation of activity was directly tied to public awareness or disclosure. Analysts expressed high confidence that the threat actor also actively targeted ConnectWise Cloud Management applications built for Exchange Online, Microsoft Teams, and SharePoint, confirming explicit abuse of the Teams application within at least one inspected tenant. Because those specific integration apps did not appear to be immediately disabled by the initial wave of vendor mitigations, researchers warned that additional residual activity could potentially stem from them, prompting ongoing, active investigations by security operations centers.
By late Saturday, Huntress identified a distinct, secondary wave of targeted attempts originating from the IP address 144.172.64[.]128. These focused efforts, which singled out a narrow and sensitive scope of sixteen enterprise tenants, ultimately proved unsuccessful. The targeted entities primarily operate within policy, national security, trade, and critical mineral sectors, suggesting a deliberate, high-value espionage or disruption motive rather than opportunistic spraying.
For this newly identified target set, the initial reconnaissance and attack sweep targeted Graph tokens from the SkyKick application during a multi-hour window. A subsequent sweep targeted the exact same tenants shortly afterward, characterized by manual techniques zeroing in on Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs.
Overall, managed security providers have identified nearly one thousand Entra tenants showing sign-in activity originating from the IP address associated with the unauthorized access, with approximately three hundred attempts succeeding. Despite successful authentication events in some cases, the absence of a registered service principal in certain targeted tenants successfully blocked the threat actor from achieving meaningful post-compromise access.
Security experts recommend that IT partners and administrators implement robust hardening measures within Microsoft Entra ID to mitigate potential damage in the event of future application credential thefts. Implementing strict application management policies can help restrict or block the creation of client secrets on app registrations and enforce tighter caps on credential lifetimes. Furthermore, limiting the personnel assigned to high-privilege roles such as Application Administrator and Cloud Application Administrator reduces the attack surface for unauthorized credential generation.
While advanced controls like Conditional Access for workload identities require appropriate licensing to restrict where an application is permitted to sign in from, and Microsoft Entra ID Protection can automatically flag risky service principals, experts emphasize that these tools serve as defense-in-depth measures rather than direct replacements for rigorous credential hygiene and continuous log monitoring.
