ConnectWise suspends cloud backup services after application identity breach

ConnectWise has suspended its Cloud Backup service and initiated a broad credential reset after detecting unauthorized access to application identities. The company began rolling out mitigations on October 17, 2026, three days after first identifying the security incident. This response includes disabling affected connections and enlisting third-party specialists to manage the remediation process.

What happened

The security incident specifically targeted application identities associated with ConnectWise Cloud Backup. In response, ConnectWise disabled the affected application connections and suspended the Cloud Backup service entirely. As a precautionary measure, the company also suspended two other integrated services: SaaS Security and Cloud Management. These suspensions remain in place while the company validates the effectiveness of its containment measures.

ConnectWise stated that it has strengthened administrative-access protections, reset accounts, and replaced application credentials. The company emphasized that it has not observed any successful threat activity in the environments it directly monitors. However, it clarified that this observation does not guarantee that individual partner or customer Microsoft 365 tenants are unaffected. ConnectWise urged partners to review each potentially affected tenant individually before reconnecting any applications.

Independent cybersecurity firm Huntress provided additional context by sharing indicators of compromise observed in connection with the activity. Huntress researchers reviewed application sign-ins across more than 10,000 tenants using ConnectWise applications. They identified specific IP addresses linked to the incident, noting that only one address produced actual application sign-in activity, while others were associated with password spray attacks that may be unrelated.

How it works

The attack vector involved unauthorized access to vendor credentials, which allowed the threat actor to perform application sign-ins. According to Huntress, the primary IP address associated with these application sign-ins was 144.172.64[.]128. Once inside a tenant, the attackers followed a consistent modus operandi. The compromised application granted itself Global Administrator privileges, a high-level permission that provides extensive control over the Microsoft 365 environment.

After escalating privileges, the attackers added new secrets to a small number of other applications registered within the tenant. This technique ensures persistence, allowing the attacker to maintain access even if the initial entry point is discovered and closed. Huntress noted that the choice of which applications to backdoor appeared random, with no regard for what those applications could actually do. The only consistent criterion was structural: credentials were planted in applications registered inside the affected tenant.

While the attackers likely used this access to read directory data via Microsoft Graph, there are currently no signs that they weaponized the access for mailbox manipulation, file theft, or policy changes. Other IP addresses in the same provider range were observed conducting broad password spray attacks, but Huntress determined these were unlikely related to the specific application sign-in activity targeting ConnectWise identities.

Key details

• ConnectWise began mitigations on October 17, 2026, at 5:00 a.m. UTC, three days after identifying the incident.
• Cloud Backup, SaaS Security, and Cloud Management services are currently suspended as a precaution.
• The primary indicator of compromise for application sign-ins is the IP address 144.172.64[.]128.
• Attackers escalated privileges by granting the compromised application Global Administrator rights.
• Persistence was achieved by adding new secrets to other randomly selected applications within the tenant.
• ConnectWise has published technical guidance to help partners investigate potential unauthorized activity.

Why it matters

This incident highlights the risks inherent in supply chain dependencies, particularly when managed service providers (MSPs) have high-privilege access to customer environments. For IT leads and security engineers, the compromise of application identities is particularly concerning because it bypasses traditional user-centric security controls like multi-factor authentication. When an application identity is compromised, the attacker operates with the permissions granted to that service account, which in this case included the ability to elevate to Global Administrator.

The suspension of critical services like Cloud Backup and SaaS Security demonstrates the operational impact of such breaches. Organizations relying on these tools for data protection and security monitoring must now navigate a period of reduced visibility and resilience. Furthermore, the warning from ConnectWise that individual tenants may still be affected places the burden of investigation on partners and customers. This requires significant effort to preserve evidence, validate findings, and assess operational impacts before restoring services.

What you can do

• Review ConnectWise’s published technical guidance to investigate potential unauthorized activity in your environment.
• Preserve relevant evidence and validate findings before making any changes to your Microsoft 365 tenant.
• Check your logs for application sign-ins from the IP address 144.172.64[.]128.
• Do not reconnect affected applications until ConnectWise provides formal restoration instructions.
• Audit your tenant for any unknown secrets added to registered applications, especially those with high privileges.
• Assess the operational impact of the suspended Cloud Backup and SaaS Security services on your business continuity plans.