# Attackers Abuse Stolen ConnectWise Credentials to Target Microsoft 365 Tenants Unauthorized access to application identities forces service suspension and triggers complex security remediation efforts. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-10-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/a9817bdc-bae3-4e26-b96f-a33246d2d4cb ## Unauthorized Application Access Detected ConnectWise discovered unauthorized access to seven of its application identities on October 14. Attackers leveraged stolen credentials to impersonate ConnectWise applications, gaining potential access to Microsoft 365 tenants. The company responded by suspending its Cloud Backup, SaaS Security, and Cloud Management services to prevent further exploitation of these compromised service principals. ## Exploiting Trusted Service Principals The attackers did not steal individual user passwords but instead hijacked existing application permissions. By pretending to be legitimate ConnectWise applications, they requested access tokens from Microsoft Entra ID. This allowed them to potentially access sensitive data including mailboxes, SharePoint documents, Teams messages, and directory information without triggering standard user-level authentication alerts. ## Persistence Beyond Credential Revocation Disabling the compromised connections stops new authentication but fails to reverse prior malicious changes. Attackers may have added new client secrets or created rogue applications within the tenant to maintain persistent access. This creates a significant remediation challenge, as simply revoking the vendor's original credential does not remove these secondary backdoors. ## Escalation to Global Administrator Security analysis indicates that attackers used initial access to assign directory roles to their own entities. By elevating themselves to Global Administrator status, they gained the ability to reset passwords, modify Conditional Access policies, and create additional applications. This level of privilege allows for long-term persistence that survives the initial vendor-side credential rotation. ## Targeted Waves and Sector Focus Cybersecurity firm Huntress identified malicious sign-ins from IP address 144.172.64.128. While initial activity was broad, a second manual wave specifically targeted 16 tenants across policy, national security, and critical minerals sectors. Although these specific attempts failed, the manual nature of the targeting suggests a sophisticated actor seeking high-value intelligence within sensitive environments. ## Operational Impact of Suspension ConnectWise suspended its Cloud Backup service to protect users, but this action halted all scheduled backups and restoration capabilities. While the company confirms that existing archives remain encrypted and isolated, the ongoing downtime creates significant operational risks. Organizations relying on this service currently lack the ability to recover their systems or data. ## Comprehensive Forensic Investigation Required ConnectWise has mobilized internal security teams and engaged a third-party incident response firm to investigate the breach. The investigation spans all partner-facing services to ensure no other products are affected. Forensic teams are actively monitoring the backup infrastructure, though the full extent of the attackers' actions within individual customer environments remains under assessment. ## Critical Remediation Steps for Admins Administrators must audit their Microsoft 365 tenants for suspicious sign-ins from 144.172.64.128 since October 13. Before taking containment actions, organizations should preserve audit logs to prevent evidence loss. Essential checks include reviewing application credentials, federation trusts, directory role assignments, and mailbox forwarding rules to identify and remove any unauthorized persistence mechanisms established by attackers. ## Sources covering this story - https://securityaffairs.com/201236/hacking/attackers-abuse-stolen-connectwise-application-credentials-to-target-microsoft-365.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._