ConnectWise has disabled seven of its application identities after unknown attackers gained unauthorized access to them and used that access to compromise customer Microsoft 365 tenants. The IT management software provider took action on October 17, 2026, at 07:00 UTC, revoking certificates tied to affected application connections and suspending its Cloud Backup service as part of its response to the ConnectWise Cloud Backup breach.
What does disabling the connections actually fix?
ConnectWise was clear that cutting off the affected identities stops new logins through those connections, but it does not undo changes attackers already made inside a customer’s tenant. The shared Cloud Backup credentials involved are no longer valid, though previously issued access tokens may still work until they expire. As a result, scheduled backups aren’t running and customers can’t access affected backup archives or restore from them right now. The company says existing archives remain encrypted, isolated, and preserved, with no evidence they were accessed. ConnectWise also took its SaaS Security and Cloud Management products offline out of caution while the investigation continues, and said it first spotted the issue on October 14, 2026.
The danger here is that stolen application credentials let an attacker act as the application itself inside Microsoft 365, skipping the need to steal individual passwords. With broad permissions, that access can be used to reach mailboxes, SharePoint files, and Teams messages, and even to grant the attacker Global Administrator rights or plant new credentials for persistence — similar in spirit to how NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions abused trusted app connections to hijack Microsoft 365 sessions.
What is Huntress seeing on its end?
Security firm Huntress told reporters it last saw malicious sign-ins from the original attacker address on October 15, with manual activity continuing until around 14:20 UTC that day. Huntress said it has high confidence the attackers also targeted ConnectWise’s Cloud Management apps for Exchange Online, Teams, and SharePoint — apps that, unlike Cloud Backup, don’t appear to have been disabled yet. The firm also flagged a second, unsuccessful wave of attempts on October 15 from IP address 144.172.64[.]128 against 16 tenants in policy, national security, trade, and critical mineral sectors. Overall, Huntress identified nearly 1,000 Entra tenants with sign-in activity from the suspect IP, with around 300 of those sign-ins succeeding. This incident follows a pattern of supply-chain-style risk in widely used IT tools, a theme also seen when CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks was flagged as actively exploited.
المصدر: The Hacker News
