# ConnectWise Suspends Cloud Backup Following Microsoft 365 Tenant Compromise Unauthorized access to application identities forces service suspension and urgent security remediation for customers. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-18 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/77d910d5-69c7-4c1f-a48c-7ca96196bb1e ## Unauthorized Application Access Detected ConnectWise identified unauthorized access to its application identities on October 14, 2026, through advanced security monitoring. The breach allowed threat actors to compromise Microsoft 365 tenants by abusing application credentials. In response, the company disabled seven application identities and suspended its Cloud Backup service on October 17 to prevent further unauthorized authentication. ## Credential Abuse Mechanism Explained The attackers exploited ConnectWise application credentials to authenticate as the software itself within Microsoft Entra ID. This method bypassed individual user password requirements, granting access to sensitive services like Exchange Online, SharePoint, and Teams. By leveraging existing application permissions, the threat actors could potentially escalate privileges to Global Administrator roles. ## Persistence Through Secret Injection Beyond initial access, attackers attempted to establish persistence by adding new client secrets to trusted applications within compromised tenants. Even after ConnectWise revoked the original compromised credentials, these injected secrets could allow continued unauthorized access. Consequently, simply disabling the primary connection does not automatically reverse changes made inside a customer's tenant. ## Scope of Service Disruptions ConnectWise has taken its SaaS Security and Cloud Management platforms offline as a precautionary measure during the ongoing investigation. While scheduled backups are currently halted and restoration capabilities remain unavailable, the company confirmed that existing backup archives are encrypted and isolated. There is currently no evidence that these specific archives were breached. ## Targeted Second Wave Analysis Security firm Huntress identified a second, targeted wave of attempts on October 15 originating from a specific IP address. This campaign focused on 16 high-profile tenants across the policy, national security, and critical mineral sectors. Although these specific attempts were unsuccessful, they demonstrated a sophisticated, manual approach to exploiting Microsoft 365 management APIs. ## Widespread Impact and Observations Huntress reported nearly 1,000 Entra tenants showing sign-in activity from the malicious IP address, with approximately 300 successful logins. However, the absence of specific service principals in some environments prevented further exploitation. While malicious activity has not been observed since October 15, investigations into other potentially affected management applications remain active. ## Recommended Remediation Strategies Partners are urged to review all application credentials and permissions immediately. Security experts recommend implementing application management policies to restrict client secrets and cap credential lifetimes. Additionally, utilizing Conditional Access for workload identities and monitoring Microsoft Entra ID Protection alerts can help identify risky service principals and mitigate future unauthorized access attempts. ## Operational Security Lessons Learned This incident highlights the critical risk of over-privileged application identities in cloud environments. Organizations must treat service principals with the same scrutiny as human accounts. Moving forward, visibility into downstream customer environments remains a challenge, emphasizing the need for robust, proactive security configurations and continuous monitoring of all third-party integrations. ## Sources covering this story - https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._