ConnectWise has shut down seven application identities and suspended its Cloud Backup service after unknown attackers gained unauthorized access to the identities and used them to compromise Microsoft 365 customer environments. The IT management software provider took the action on October 17, 2026, at 07:00 UTC, revoking certificates used for affected application connections across all users. The disabled identities include ConnectWise Cloud Backup and six ConnectWise Cloud Management applications tied to MS Teams, Exchange Online, MS Graph, Partner Center, and SharePoint Online.
ConnectWise spotted the incident on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting the company to activate internal and external incident investigation and response actions. Security firm Huntress identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity, with 300 of those sign-ins succeeding. However, the absence of a service principal in some tenants prevented the threat actor from gaining access to those environments. Huntress last observed malicious sign-ins from the original IP address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day. A second, targeted wave of attempts from IP address "144.172.64[.]128" on October 15 singled out a narrow scope of 16 tenants in the policy, national security, trade, and critical mineral sectors, though these efforts were unsuccessful.
ConnectWise said that "disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant." The company noted that "the affected shared Cloud Backup credentials are no longer valid," though previously issued access tokens may remain usable until they expire or are otherwise invalidated. Jon Semon, Principal Security Operations Analyst at Huntress, told The Hacker News that "if the threat actor was able to add credentials to applications in Microsoft tenants, those credentials would let them keep access and act as the application." ConnectWise emphasized that existing backup archives remain encrypted, isolated, and preserved, with no evidence they were breached or accessed by attackers.
The attack poses significant danger because it allows an attacker to abuse the application's credentials to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker can request access tokens from Microsoft Entra ID based on the application's existing permissions, potentially enabling access to mailboxes, SharePoint documents, Teams messages, and directory information. With ConnectWise's applications operating with extensive permissions to perform backups and management tasks, the theft of the credential allows the threat actor to authenticate as the application itself and expand their access by adding it to the Global Administrator role, adding client secrets to other trusted applications in the tenant, and creating new applications and granting them permissions. By doing so, the client secrets offer a way to authenticate as that application and establish persistence, providing an alternative means to regain access to the compromised environment even if the original compromised credential is later revoked.
Partners are advised to review both their own Microsoft 365 tenant and each managed customer tenant, verify the status of the listed application connections and keep affected applications disabled until further notice, and review sign-ins across identities from October 13, 2026, through the current time, specifically for activity originating from IP address "144.172.64[.]128." Huntress recommended that partners preserve available sign-in and audit records before initiating containment steps, review application and user authentication along with application credentials and federation trusts, and check for unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access. ConnectWise has temporarily taken SaaS Security and Cloud Management offline while it completes its review of the incident, and scheduled backups are not running while access to affected backup archives and restoration capabilities remains unavailable. The exact credential-exposure mechanism is the subject of an ongoing analysis, and it remains unclear if a product vulnerability contributed to the compromise of the application identities. For managed service providers relying on application-based automation, this incident reveals the fragility of delegated trust models when credentials are centralized across thousands of downstream environments. The operational paralysis caused by suspending critical backup and management services may force partners to reconsider whether convenience justifies the concentration of risk inherent in such architectures.