ConnectWise disables app identities after Microsoft 365 tenant compromise

ConnectWise has disabled seven of its application identities and suspended its Cloud Backup service following a security incident where threat actors gained unauthorized access to these identities. The breach, identified on October 14, 2026, allowed attackers to compromise Microsoft 365 tenants belonging to ConnectWise customers, prompting immediate mitigation actions by the IT management software provider on October 17, 2026.

What happened

On October 17, 2026, at 07:00 UTC, ConnectWise took decisive action by disabling seven specific application identities and revoking the certificates used for affected application connections across all users. This move effectively suspended the Cloud Backup service, halting scheduled backups and making restoration capabilities temporarily unavailable. The company stated that while existing backup archives remain encrypted, isolated, and preserved with no evidence of breach, the shared Cloud Backup credentials are no longer valid. ConnectWise also temporarily took its SaaS Security and Cloud Management services offline as a precautionary measure while it continues its investigation into the incident.

The compromised application identities include ConnectWise Cloud Backup and six ConnectWise Cloud Management variants covering MS Teams, Exchange Online, MS Graph, Partner Center, and SharePoint Online. ConnectWise emphasized that disabling these connections prevents new authentication but does not reverse any changes previously made inside a customer’s tenant. Previously issued access tokens may remain usable until they expire, meaning that any unauthorized credentials or permissions established through separate identities require additional review and remediation by the affected partners and customers.

How it works

This incident highlights the risks associated with service principal credentials in cloud environments. Instead of stealing individual user passwords, the attackers obtained the application identities’ credentials. By authenticating as the application itself, the threat actors could request access tokens from Microsoft Entra ID based on the extensive permissions already granted to ConnectWise’s tools for backup and management tasks. This method allows an attacker to bypass multi-factor authentication protections typically tied to user accounts.

Once authenticated as the application, the attackers could potentially access mailboxes, SharePoint documents, Teams messages, and directory information. More critically, they could expand their access by adding the compromised application to the Global Administrator role, creating new applications, and adding client secrets to other trusted applications in the tenant. These new client secrets provide a persistent backdoor, allowing attackers to regain access even if the original compromised credential is revoked. This persistence mechanism makes remediation complex, as simply rotating the initial password or certificate is insufficient if new secrets have been planted.

Key details

• ConnectWise disabled seven application identities on October 17, 2026, including Cloud Backup and various Cloud Management services.
• The issue was identified on October 14, 2026, through internal cybersecurity monitoring, though the exact credential-exposure mechanism remains under analysis.
• Huntress observed malicious sign-ins from IP address "144.172.64[.]128" and confirmed abuse of the Teams app in at least one tenant.
• A second wave of targeted attempts occurred on October 15, focusing on 16 tenants in policy, national security, and critical mineral sectors, but was unsuccessful.
• Out of nearly 1,000 Entra tenants with sign-in activity from the suspicious IP, 300 were successful, though some were blocked by the absence of a service principal.
• Existing backup archives are reported as encrypted and untouched, but scheduled backups are currently halted.

Why it matters

For software developers and IT leads managing Microsoft 365 environments, this incident underscores the critical importance of securing service principals and application permissions. Unlike user-centric attacks, compromising an application identity grants broad, automated access that can be difficult to detect without rigorous audit logging. The ability of attackers to plant new client secrets means that trust boundaries within the tenant can be permanently altered, requiring a thorough review of all application registrations and consent grants.

The supply chain nature of this attack also demonstrates how vulnerabilities in managed service provider tools can cascade to hundreds of downstream customers. Even if a product vulnerability did not directly cause the compromise, the extensive permissions granted to management tools create a high-value target. Organizations must assume that any application with high-level privileges could be a vector for lateral movement, necessitating stricter controls on who can manage application credentials and how those credentials are stored and rotated.

What you can do

• Review sign-in logs for your Microsoft 365 tenant and all managed customer tenants from October 13, 2026, onwards, specifically filtering for activity from IP address "144.172.64[.]128".
• Verify the status of the seven disabled ConnectWise application identities and ensure they remain disabled until further notice from the vendor.
• Preserve all available sign-in and audit records before initiating any containment or cleanup steps to maintain forensic integrity.
• Audit application credentials, federation trusts, directory roles, and recent policy changes to identify any unauthorized additions or modifications.
• Check for unauthorized mailbox forwarding rules, inbox rules, transport rules, and delegated mailbox access that may have been created during the compromise.
• Implement application management policies to restrict client secrets on app registrations and cap credential lifetimes to limit the window of opportunity for attackers.