ConnectWise Suspends Cloud Backup Services After Attackers Breach Microsoft 365 Tenants

ConnectWise disabled seven application identities and suspended its Cloud Backup service on October 17, 2026, after unknown threat actors gained unauthorized access to application credentials and compromised Microsoft 365 tenants across nearly 1,000 Entra environments.

The incident represents one of the more consequential supply-chain-style attacks targeting managed service providers in recent memory. Because ConnectWise's applications operate with extensive permissions to perform backups and management tasks, the theft of a single application credential gave attackers a skeleton key to potentially hundreds of downstream customer environments — without ever needing to steal an individual user's password. This is precisely the kind of systemic risk that makes understanding the security challenges inherent in cloud computing environments so critical for organizations relying on third-party managed service tools.

How the Attack Unfolded

ConnectWise said it identified the issue on October 14, 2026, through its internal cybersecurity monitoring. The company activated incident investigation and response actions immediately and took the decision to disable the affected application identities at 07:00 UTC on October 17.

The seven disabled application identities included:

• ConnectWise Cloud Backup
• ConnectWise Cloud Management
• Related integrations covering Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online

"Disabling the affected connections prevents new authentication through those connections; it does not reverse changes previously made inside a tenant," ConnectWise stated. The company also warned that previously issued access tokens may remain usable until they expire or are separately invalidated — a critical detail that organizations must not overlook when assessing their exposure window.

Scheduled backups are not currently running and access to backup archives and restoration capabilities remains unavailable. ConnectWise stressed that existing archives remain encrypted, isolated, and preserved with no evidence of breach or unauthorized access.

Jon Semon, Principal Security Operations Analyst at Huntress, confirmed the timeline of malicious activity. "We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day," Semon said. Huntress has not identified new malicious activity since October 15 but noted there is no evidence the stoppage resulted from public disclosure — meaning organizations cannot assume the threat actor simply moved on.

The Credential Exposure Pathway

The exact credential-exposure mechanism remains under active analysis, and it is still unclear whether a product vulnerability contributed to the initial compromise. What is clear is the pathway the attackers exploited once they held the application credential.

By authenticating as the ConnectWise application itself, threat actors could request access tokens from Microsoft Entra ID based on the application's existing permissions. From there, attackers could potentially expand access by:

• Adding themselves to the Global Administrator role
• Injecting client secrets into other trusted applications within the tenant
• Creating entirely new applications with elevated permissions — establishing persistence that survives the revocation of the original stolen credential

This attack model is a stark illustration of why application credentials must be treated with the same sensitivity as privileged user passwords. The absence of that discipline is frequently what transforms a contained credential leak into a full-scale tenant compromise.

The Scope of Compromise

Scale and Initial Access

The numbers emerging from the investigation paint a significant picture. Huntress identified almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized access. Of those, 300 sign-ins succeeded. However, the absence of a service principal in some tenants prevented the threat actor from gaining meaningful access even after a successful authentication.

A Deliberate Second Wave

A second targeted wave of attempts was identified from IP address 144.172.64[.]128 on October 15. That wave singled out just 16 tenants spanning the policy, national security, trade, and critical mineral sectors — suggesting deliberate, intelligence-driven targeting rather than opportunistic scanning.

"The first sweep targeted Graph tokens from the SkyKick app and occurred on October 15 between 09:25:04 and 12:35:50 UTC," Huntress reported. "The second sweep hit the same tenants on the same date, between 13:54:39 and 14:20:24 UTC. This sweep appeared to be manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and the Office 365 Management APIs."

The precision of that second wave — narrowing from nearly 1,000 tenants down to 16 high-value targets in policy and national security sectors — strongly suggests the initial sweep served as reconnaissance. The threat actor used broad access to identify the most strategically valuable environments before conducting a deliberate, manual intrusion. This is sophisticated operational tradecraft, not automated exploitation.

Huntress also confirmed abuse of the Teams application in at least one tenant. "Those apps do not appear to have been disabled by ConnectWise, so additional activity could come from them, and we are actively investigating," Semon said.

ConnectWise subsequently shared two additional IP addresses linked to the activity: 144.172.64[.]99 and 144.172.64[.]60.

What Organizations Should Do Now

Immediate Investigative Steps

ConnectWise has advised partners and customers to take immediate action. Organizations should review sign-in logs across identities from October 13, 2026 through the present for activity from the identified IP addresses. Additional steps include:

• Reviewing application and user authentication records
• Checking for unauthorized mailbox forwarding rules and delegated mailbox access
• Investigating any identities changed during the suspicious activity window
• Preserving sign-in and audit records before initiating containment steps

Strengthening Entra Controls to Reduce Blast Radius

Huntress outlined several Microsoft Entra controls that can limit the damage a stolen application credential can cause. Application management policies can restrict client secrets and cap credential lifetimes. Limiting the Application Administrator and Cloud Application Administrator roles reduces the number of users who can add credentials to applications. Conditional Access for workload identities can further restrict where an application is permitted to sign in from.

For organizations looking to build more comprehensive defences, implementing multi-factor authentication controls across cloud environments is an essential layer that can significantly reduce the impact of compromised credentials, even at the application level.

Longer-Term Security Posture

Cloud Backup, SaaS Security, and Cloud Management remain suspended as ConnectWise completes remediation and security validation. The incident is an important reminder that supply-chain trust in managed service provider tools carries significant risk.

Organizations relying on third-party applications with broad Microsoft 365 permissions should audit those permissions regularly, treat application credentials with the same sensitivity as privileged user passwords, and ensure monitoring is in place to flag anomalous service principal activity before damage spreads downstream. Embedding these practices into a structured framework — informed by established cloud security best practices for enterprise environments — gives security teams the clearest path to reducing third-party application risk before an incident occurs.

For ongoing guidance on managing Microsoft Entra environments and service principal security, Microsoft's official sign-in activity monitoring documentation provides detailed technical reference for the log review process ConnectWise has recommended.