ConnectWise has disabled seven application identities and suspended several cloud services after discovering that unknown attackers gained unauthorized access to its application credentials and compromised Microsoft 365 environments.
The IT management software provider announced the security measures on October 17, 2026, as it continues investigating the incident. The affected identities are associated with ConnectWise Cloud Backup and Cloud Management services, including integrations with Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online.
ConnectWise said it disabled the seven identities at 07:00 UTC on October 17 and revoked certificates used by affected Cloud Backup connections across its customer base. The company also suspended its Cloud Backup service, leaving scheduled backups unavailable and preventing customers from accessing affected backup archives or performing restorations.
The company stressed that disabling the connections prevents new authentication through those identities but does not undo changes attackers may have already made within customer environments. Previously issued access tokens could also remain valid until they expire or are revoked. Any unauthorized credentials, permissions, or access established through other identities must be investigated and removed separately.
ConnectWise said existing backup archives remain encrypted, isolated, and preserved, adding that it has found no evidence that attackers accessed or compromised them. The company has also temporarily taken its SaaS Security and Cloud Management services offline while its investigation continues.
The incident was first identified on October 14 through the company’s cybersecurity monitoring systems, triggering internal and external incident response efforts. ConnectWise said it has not observed successful malicious activity in the environments it monitors since implementing its security measures. However, it cautioned that it cannot directly verify the status of every downstream customer environment.
Investigators have yet to determine exactly how the application credentials were exposed or whether a software vulnerability contributed to the compromise.
The incident poses a significant risk because attackers can abuse compromised application credentials to access Microsoft 365 environments without stealing each customer’s password individually. By authenticating as a trusted application, an attacker may obtain access tokens from Microsoft Entra ID based on the permissions already granted to that application.
Depending on those permissions, the compromised identities could provide access to Exchange Online mailboxes, SharePoint documents, Microsoft Teams messages, and directory information. Applications with extensive administrative permissions could potentially give attackers opportunities to expand their access and maintain persistence within affected tenants.
For example, attackers may attempt to assign compromised applications the Global Administrator role, add client secrets to other trusted applications, or create new application registrations with additional permissions. Such changes could allow them to retain access even after the original compromised credentials are revoked.
Security researchers at Huntress reported that malicious sign-ins from the original IP address were last observed on October 15 at 08:45 UTC, while targeted manual activity continued until approximately 14:20 UTC that day. Huntress said it had not identified further malicious activity since October 15, although it warned that attackers could continue operating if they had established alternative credentials within customer environments.
Huntress also confirmed that the attackers appeared to have targeted ConnectWise Cloud Management applications associated with Exchange Online, Microsoft Teams, and SharePoint. The company confirmed abuse of the Teams application in one tenant and said it was continuing to investigate the other affected integrations.
A second, targeted wave of attempts was also identified from the IP address 144.172.64[.]128 on October 15. According to Huntress, the activity focused on 16 tenants associated with the policy, national security, trade, and critical minerals sectors. The attempts were unsuccessful.
The first wave of activity targeting these tenants involved requests for Microsoft Graph tokens through the SkyKick application between 09:25:04 and 12:35:50 UTC. A second sweep, conducted between 13:54:39 and 14:20:24 UTC, appeared to involve manual targeting of Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Microsoft Entra, and Office 365 Management APIs.
Huntress said it had identified sign-in activity associated with the suspicious IP address across nearly 1,000 Microsoft Entra tenants, with approximately 300 successful sign-ins. In some environments, the absence of the relevant service principal reportedly prevented the attackers from gaining access despite successful authentication.
Security teams and ConnectWise partners have been advised to investigate both their own Microsoft 365 environments and every managed customer tenant, including those with dormant SkyKick connections. They should verify the status of affected application identities, keep compromised or potentially affected connections disabled, and examine sign-in records from October 13 onward for activity originating from the suspicious IP address.
Huntress also recommends preserving available sign-in and audit logs before making containment changes. Investigators should review application credentials, authentication activity, federation trusts, directory roles, application owners, consent grants, and recent policy changes. They should also look for suspicious mailbox forwarding configurations, inbox and transport rules, delegated mailbox access, and other unauthorized identity modifications.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Microsoft Entra security controls can help reduce the risk of similar attacks. Application management policies can restrict the creation of client secrets and limit their lifetimes, while tighter controls over Application Administrator and Cloud Application Administrator roles can reduce opportunities for attackers to establish persistent access.
Conditional Access policies for workload identities can also restrict where applications are permitted to authenticate, although additional licensing may be required. Microsoft Entra ID Protection can help identify risky service principals and suspicious application activity.
