ConnectWise disables cloud apps after Microsoft 365 tenant access
Original title: ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Seven application identities were disabled October 17; Huntress says a later wave against 16 tenants failed.
ConnectWise said unknown actors obtained unauthorized access to application identities and compromised Microsoft 365 tenants. On October 17 it disabled seven ConnectWise application identities and suspended Cloud Backup by revoking certificates. Archives remain encrypted with no evidence of attacker access, but backups and restores are unavailable. SaaS Security and Cloud Management were taken offline. Huntress reported malicious sign-ins through October 15 and a failed second wave against 16 tenants in policy, national security, trade, and critical-mineral sectors.
Unconfirmed: ConnectWise says it is unclear whether a product vulnerability exposed the application identities.
- ConnectWise identified the issue on October 14, 2026, through its monitoring.
- Last malicious sign-ins from the original address were October 15 at 08:45 UTC.
- Huntress confirmed abuse of the Teams app in one tenant.
- A second wave from 144.172.64.128 targeted 16 tenants and failed.
- Issued access tokens may stay usable until they expire or are invalidated.
Impact: Unauthorized access to customer Microsoft 365 data via app credentials
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
| ConnectWise Cloud Management | — |
- 1.Review tenants for added client secrets, new apps, and Global Administrator changes.
- 2.Invalidate tokens and credentials tied to the seven disabled ConnectWise identities.
- 3.Do not rely on Cloud Backup schedules or restores while the service is suspended.
- ATT&CK
- T1550.001 Application Access TokenT1098.001 Additional Cloud CredentialsT1098 Account ManipulationT1078.004 Cloud Accounts
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15. These efforts, which singled out a narrow |
From the original article
5 min read at thehackernews.com
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.