ConnectWise Suspends Cloud Backup Services Following Microsoft 365 Tenant Compromise
IT management software provider ConnectWise has initiated a series of emergency security measures, including the suspension of its Cloud Backup service, following the discovery of unauthorized access to several of its application identities. The incident, which came to light on October 14, 2026, involves the exploitation of application-level credentials to gain entry into customer Microsoft 365 environments.
Understanding the Scope of the Compromise
The security incident centers on the unauthorized use of specific ConnectWise application identities. By leveraging these compromised credentials, threat actors were able to authenticate directly into Microsoft 365 tenants without needing to steal individual user passwords. This method allowed the attackers to request access tokens from Microsoft Entra ID, granting them permissions commensurate with the compromised applications.
ConnectWise acted on October 17, 2026, to disable seven specific application identities, including those associated with Cloud Backup, Cloud Management for Microsoft Teams, Exchange Online, Microsoft Graph, SharePoint Online, and the Partner Center. The company also revoked the certificates used for these connections to prevent further unauthorized authentication. While ConnectWise emphasized that its existing backup archives remain encrypted and isolated with no evidence of direct exfiltration, the restoration and backup scheduling functions currently remain offline.
Persistence and Escalation Risks
Security researchers at Huntress, who have been tracking the activity, noted that the danger lies in the potential for attackers to establish long-term persistence. By acting as the compromised application, threat actors could potentially elevate their privileges within a tenant, such as assigning the application to the Global Administrator role or adding new client secrets to existing applications. These actions create secondary access paths that remain functional even if the original compromised credentials are revoked.
Huntress reported observing malicious sign-in attempts from the IP address 144.172.64.128, which targeted approximately 1,000 Entra tenants, with 300 successful sign-ins. While the initial wave of activity focused on Cloud Backup, investigators found evidence of attempts to exploit other management applications, including those linked to Microsoft Teams and SharePoint.
Recommended Remediation Steps
Organizations utilizing ConnectWise services are urged to conduct a comprehensive audit of their Microsoft 365 environments. This includes reviewing sign-in logs dating back to October 13, 2026, for any activity originating from the identified malicious IP address. Administrators should also inspect their tenants for unauthorized changes to directory roles, newly created application credentials, and suspicious inbox or transport rules.
Experts recommend that IT teams leverage Entra ID security controls to mitigate the impact of such compromises. Implementing application management policies to restrict client secrets, enforcing conditional access for workload identities, and monitoring for risky service principals can significantly harden a tenant against similar supply chain attacks. As the investigation continues, ConnectWise maintains that its internal cybersecurity monitoring was instrumental in identifying the anomaly, and no further successful threat activity has been observed in the environments under their direct observation since the mitigations were implemented.
