ConnectWise Credential Compromise Impacts 173 Microsoft 365 Tenants
Threat actors exploit vendor backup credentials to gain unauthorized access to enterprise environments.
1Unauthorized Access Campaign
Cybersecurity researchers identified an active campaign where threat actors exploited a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup. This breach allowed unauthorized access across 173 partner and customer tenants. The attackers utilized the vendor's broad permissions to interact with sensitive environments, bypassing standard security perimeters through legitimate service application tokens.
2Exploitation of Graph Tokens
On October 15, 2026, attackers used the compromised credential to obtain Microsoft Graph tokens from IP address 144.172.64.128. The malicious activity occurred between 06:13 and 08:34 UTC, with scripts moving through tenants in sorted GUID order. This automated approach indicates a highly targeted effort to maximize impact across the vendor's ecosystem.
3Escalation to Global Administrator
In specific instances, attackers leveraged the ConnectWise Cloud Management app to assign themselves Global Administrator privileges. By running Python scripts, they modified trusted MSP management and security platform applications, adding new client secrets. This tactic effectively extended the threat actor's reach beyond the initial backup service, compromising multiple privileged tools simultaneously.
4Scope of Inherited Permissions
The compromised application possesses extensive permissions, including read and write access to mailboxes, OneDrive, SharePoint, and Teams data. Because the attackers inherit these existing consents, they can restore or exfiltrate data without triggering traditional alerts. Directory reads through Microsoft Graph often leave no audit trail, complicating detection efforts for affected organizations.
5Limitations of Session Revocation
Security experts warn that simply revoking user sessions does not terminate the unauthorized access. While disabling the application prevents the issuance of new tokens, previously issued tokens remain valid for up to 90 minutes. Tenants remain exposed until ConnectWise completes a full rotation of the compromised credentials across their entire infrastructure.
6Recommended Mitigation Steps
Organizations are advised to immediately disable the ConnectWise Cloud Backup application until the vendor confirms credential resets. Security teams should audit Entra logs for any unauthorized directory role changes since October 13, 2026. Enabling Microsoft Graph activity logs is critical to identifying potential data exfiltration that occurred during the active campaign window.
7Broader Supply Chain Risks
This incident coincides with reports of ephemeral supply chain tampering involving AOMEI Backupper software. The UNC7017 threat cluster utilized brief, five-to-ten-minute windows to modify update servers, delivering malicious payloads like CROSSROAD and SHINYROAD. These concurrent events highlight the growing trend of attackers targeting software update infrastructure to bypass traditional security defenses globally.
8Strategic Security Implications
The ConnectWise breach underscores the inherent risks of granting broad, persistent permissions to third-party managed service provider applications. As attackers increasingly target the supply chain, organizations must implement stricter runtime identity controls. Proactive auditing of application consents and monitoring for anomalous script execution are now essential components of modern enterprise defense strategies.