"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," ConnectWise said.
ConnectWise actions and timing
On October 17, 2026 at 07:00 UTC ConnectWise disabled seven application identities and suspended its Cloud Backup service after unknown threat actors obtained unauthorized access to those application identities and compromised Microsoft 365 tenants, the company said. As part of the suspension, ConnectWise revoked certificates used for the affected application connections across all users and temporarily took SaaS Security and Cloud Management offline while it completes its review of the incident.
ConnectWise reported it first identified the issue on October 14 through what it described as "advanced cybersecurity monitoring and diligence," and that it activated internal and external incident investigation and response actions. Since implementing mitigations, the company said it has not observed successful threat activity in the environments it monitors, while cautioning that this does not establish the status of downstream customer environments that it cannot directly observe.
The seven disabled application identities
- ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae
- ConnectWise Cloud Management - 2399d300-6fca-4e6a-a686-399fefe75b83
- ConnectWise Cloud Management - MS Teams - 24205314-2b89-4e07-a2a4-579e898a5640
- ConnectWise Cloud Management - Exchange Online - b78f6a77-d4e5-46fb-87e5-d1648bd02519
- ConnectWise Cloud Management - MS Graph - 0de14c77-b9b0-4137-9360-34878a929827
- ConnectWise Cloud Management - Partner Center - 412dcf96-176d-4b3a-a1b0-4981ad66971e
- ConnectWise Cloud Management - SharePoint Online - b2b55f5b-7758-4719-8d8f-88ae172e6bdb
ConnectWise warned that disabling those connections "prevents new authentication through those connections; it does not reverse changes previously made inside a tenant." The company also noted that previously issued access tokens may remain usable until they expire or are otherwise invalidated, and that any unauthorized credentials or permissions established through separate identities will require additional review and remediation.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow attackers can abuse stolen application credentials
The company and outside observers described the core danger: an attacker who steals an application's credential can authenticate as that application and request access tokens from Microsoft Entra ID based on the application's existing permissions. With the wide permissions required for backup and management tasks, a stolen ConnectWise credential could let an attacker access mailboxes, SharePoint documents, Teams messages, and directory information, depending on granted permissions.
The threat actor could expand access inside a tenant by adding the compromised application to the Global Administrator role, adding client secrets to other trusted applications, or creating new applications and granting them permissions. Those newly added client secrets would serve as alternate credentials for persistence, allowing the attacker to regain access even if the original secret is later revoked.
ConnectWise said it is still analyzing the exact credential-exposure mechanism and has not determined whether a product vulnerability contributed to the compromise.
Huntress findings: a targeted second wave and the IP address
Managed security provider Huntress reported that malicious sign-ins from the original address were last observed on October 15, with targeted manual activity continuing until about 14:20 UTC that day. Jon Semon, Principal Security Operations Analyst at Huntress, told The Hacker News that Huntress has not identified new malicious activity since October 15 but said there is no evidence the stoppage was the result of public disclosure.
Huntress identified a "second, targeted wave of attempts" originating from IP address 144.172.64[.]128 on October 15 that specifically targeted 16 tenants in the policy, national security, trade, and critical mineral sectors; those attempts were unsuccessful. In total Huntress said it has observed sign-in activity from the IP address against almost 1,000 Entra tenants, with roughly 300 successful sign-ins. In some tenants the absence of a service principal reportedly prevented the attacker from gaining access despite successful sign-ins.
Huntress also reported confirmed abuse of a Teams app in one tenant and said it has confidence the threat actor targeted ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint.
What this means for partners, security teams, and affected tenants
- Partners: Huntress advised partners to review their own Microsoft 365 tenant and each managed customer tenant (including environments with dormant SkyKick connections), verify the status of the listed application connections, and keep affected applications disabled until further notice.
- Security teams: Huntress recommended reviewing sign-ins from October 13 onward, preserving sign-in and audit records before containment, checking application and user authentication, application credentials and federation trusts, directory roles, consent grants, and recent policy changes, and investigating unauthorized mailbox forwarding, inbox or transport rules, and delegated mailbox access.
- Affected tenants: Huntress warned that application management policies, limits on who holds Application Administrator and Cloud Application Administrator roles, Conditional Access for workload identities (which requires additional licensing), and Microsoft Entra ID Protection can help limit damage or flag risky service principals—but none of those controls replace a careful review of credentials and roles.
ConnectWise's suspension of Cloud Backup and revocation of certificates is a containment step; the company and Huntress are continuing investigations, and ConnectWise has emphasized that existing backup archives remain encrypted, isolated, and preserved with no evidence of breach. The unanswered technical question the public record leaves is the precise mechanism by which the application credentials were exposed and whether product-level vulnerability played a role—an inquiry ConnectWise says is ongoing.
