ConnectWise Suspends Cloud Backup Following Microsoft 365 Tenant Compromise
Unauthorized access to application identities forces service suspension and urgent security remediation for customers.
1Unauthorized Application Access Detected
ConnectWise identified unauthorized access to its application identities on October 14, 2026, through advanced security monitoring. The breach allowed threat actors to compromise Microsoft 365 tenants by abusing application credentials. In response, the company disabled seven application identities and suspended its Cloud Backup service on October 17 to prevent further unauthorized authentication.
2Credential Abuse Mechanism Explained
The attackers exploited ConnectWise application credentials to authenticate as the software itself within Microsoft Entra ID. This method bypassed individual user password requirements, granting access to sensitive services like Exchange Online, SharePoint, and Teams. By leveraging existing application permissions, the threat actors could potentially escalate privileges to Global Administrator roles.
3Persistence Through Secret Injection
Beyond initial access, attackers attempted to establish persistence by adding new client secrets to trusted applications within compromised tenants. Even after ConnectWise revoked the original compromised credentials, these injected secrets could allow continued unauthorized access. Consequently, simply disabling the primary connection does not automatically reverse changes made inside a customer's tenant.
4Scope of Service Disruptions
ConnectWise has taken its SaaS Security and Cloud Management platforms offline as a precautionary measure during the ongoing investigation. While scheduled backups are currently halted and restoration capabilities remain unavailable, the company confirmed that existing backup archives are encrypted and isolated. There is currently no evidence that these specific archives were breached.
5Targeted Second Wave Analysis
Security firm Huntress identified a second, targeted wave of attempts on October 15 originating from a specific IP address. This campaign focused on 16 high-profile tenants across the policy, national security, and critical mineral sectors. Although these specific attempts were unsuccessful, they demonstrated a sophisticated, manual approach to exploiting Microsoft 365 management APIs.
6Widespread Impact and Observations
Huntress reported nearly 1,000 Entra tenants showing sign-in activity from the malicious IP address, with approximately 300 successful logins. However, the absence of specific service principals in some environments prevented further exploitation. While malicious activity has not been observed since October 15, investigations into other potentially affected management applications remain active.
7Recommended Remediation Strategies
Partners are urged to review all application credentials and permissions immediately. Security experts recommend implementing application management policies to restrict client secrets and cap credential lifetimes. Additionally, utilizing Conditional Access for workload identities and monitoring Microsoft Entra ID Protection alerts can help identify risky service principals and mitigate future unauthorized access attempts.
8Operational Security Lessons Learned
This incident highlights the critical risk of over-privileged application identities in cloud environments. Organizations must treat service principals with the same scrutiny as human accounts. Moving forward, visibility into downstream customer environments remains a challenge, emphasizing the need for robust, proactive security configurations and continuous monitoring of all third-party integrations.