ConnectWise has taken the aggressive step of disabling seven of its application identities and suspending critical services as part of an ongoing, high-stakes security investigation. The emergency actions were triggered after unknown threat actors successfully obtained unauthorized access to the company’s application identities, subsequently leveraging that access to compromise numerous Microsoft 365 customer tenants.
The software provider revealed that the targeted mitigation measures went into effect on October 17, 2026, at 07:00 UTC. Alongside the deactivation of the specific application identities, the company suspended its Cloud Backup service by actively revoking the certificates used for the affected application connections across all registered users.
According to ConnectWise, disabling these compromised connections immediately blocks any new authentication attempts through those specific pathways. However, the company cautioned that this operational shutoff does not automatically reverse or remediate malicious changes that attackers may have previously executed inside an individual customer tenant. Furthermore, the shared Cloud Backup credentials are now permanently invalid, though previously issued access tokens could theoretically remain functional until they naturally expire or are explicitly invalidated by administrators.
The company stressed that any unauthorized credentials, permissions, or alternative avenues of access established by the threat actors through separate identities will require thorough independent reviews and manual remediation by affected organizations. As a direct result of these emergency measures, scheduled backups are currently halted, and immediate access to affected backup archives and restoration capabilities remains temporarily offline. Despite these disruptions, ConnectWise emphasized that all existing backup archives remain fully encrypted, isolated, and preserved, noting that there is currently no evidence indicating those archives were breached, exfiltrated, or directly accessed by the malicious actors.
Out of an abundance of caution while remediation efforts continue, ConnectWise also temporarily took its SaaS Security and Cloud Management services offline to complete a comprehensive review of the security incident. The underlying issue was initially detected on October 14, 2026, through the company’s advanced cybersecurity monitoring protocols, prompting the immediate activation of both internal and external incident response teams.
While the company has not observed any successful threat activity in the environments under its direct monitoring since the mitigations were deployed, it noted that it cannot directly observe downstream customer environments by design. At this early stage of the investigation, ConnectWise has not confirmed whether a product vulnerability contributed to the compromise of the application identities, indicating that the exact credential-exposure mechanism remains the subject of ongoing analysis.
The architectural nature of this cyberattack makes it particularly dangerous for enterprise environments. Rather than requiring cybercriminals to steal individual customer passwords one by one, the breach of vendor application credentials allows attackers to authenticate directly as the trusted application itself. By utilizing these stolen credentials, malicious actors can request legitimate access tokens from Microsoft Entra ID based entirely on the application’s pre-existing, elevated permissions.
Depending on the specific scope of permissions assigned to the applications, unauthorized third parties could potentially gain deep access to a wide range of corporate Microsoft services, including sensitive email mailboxes, SharePoint documents, Microsoft Teams conversations, and directory structures. Because ConnectWise applications traditionally operate with extensive administrative privileges to seamlessly perform automated backups and routine management tasks, the theft of these credentials gives threat actors a powerful platform to expand their footprint.
Investigators point out that attackers can use this compromised access to add the application to the Global Administrator role, inject fresh client secrets into other trusted applications residing within the tenant, or even spin up entirely new applications equipped with broad administrative permissions. By generating these client secrets, threat actors can establish persistent access, ensuring they maintain a reliable backdoor into the compromised corporate environment even if the original vendor credentials are eventually revoked.
Following the initial discovery of the intrusion, security researchers have uncovered evidence of coordinated follow-up campaigns. Jon Semon, Principal Security Operations Analyst at Huntress, reported that malicious sign-ins originating from the primary attacker IP address were last observed on October 15, with targeted and manual activity continuing through the afternoon hours.
While ConnectWise’s decision to shut off access to Cloud Backup should have effectively neutralized activity through that specific vector, security analysts warn that if threat actors successfully added persistent credentials to applications inside individual Microsoft tenants, those secondary credentials would allow them to maintain unauthorized access and continue operating under the guise of the trusted application.
Huntress confirmed that it has not identified new malicious activity from the primary vector since October 15, though it noted that the cessation does not appear to be tied to public disclosures. However, researchers have high confidence that the threat actor also systematically targeted ConnectWise Cloud Management applications tailored for Exchange Online, Microsoft Teams, and SharePoint. Investigators have already confirmed the active abuse of the Teams application within at least one targeted tenant. Because those specific applications do not appear to have been immediately disabled by ConnectWise during the initial wave, researchers are actively investigating whether they represent ongoing vectors for malicious actions.
As the investigation broadened, Huntress identified a second, highly targeted wave of intrusion attempts originating from a specific external IP address on October 15. These subsequent efforts singled out a narrow, high-value scope of just 16 distinct tenants operating primarily within the policy, national security, trade, and critical mineral sectors. Fortunately, these specialized attempts were ultimately unsuccessful.
During this second wave, the first sweep targeted Graph tokens from the SkyKick application during a brief window on October 15, while a second manual sweep later that day specifically targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs across the same set of tenants.
Across all monitored telemetry, the managed security service provider has identified nearly 1,000 Entra tenants showing sign-in activity linked to the IP address associated with the unauthorized actions, with approximately 300 of those sign-in attempts succeeding. In several instances where sign-ins succeeded, the absence of an active service principal in the tenant successfully prevented the threat actor from achieving full access to the environment.
Security experts emphasize that organizations can utilize several native Entra controls to limit potential damage in the event that application credentials are compromised. Implementing robust application management policies can help restrict or outright block client secrets on app registrations while capping credential lifetimes. Furthermore, strictly limiting the personnel assigned to powerful administrative tiers, such as the Application Administrator and Cloud Application Administrator roles, significantly reduces the number of users capable of adding unauthorized credentials to existing applications.
While specialized features like Conditional Access for workload identities require additional licensing, they can effectively restrict the geographic or network locations from which an application is permitted to sign in, and Microsoft Entra ID Protection can assist in flagging risky service principals. While these defenses do not replace the critical need for routine credential reviews, security professionals note they make planted secrets considerably harder to utilize and much easier to detect.
