ConnectWise has disabled seven application identities and suspended its Cloud Backup service after unknown attackers gained unauthorized access to those identities and compromised Microsoft 365 tenants, the company said. The action came on October 17, 2026, at 07:00 UTC, with certificates used for affected application connections revoked across all users.
The disabled identities cover Cloud Backup along with Cloud Management connections for Microsoft Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online. ConnectWise said disabling the connections blocks new authentication but does not undo changes already made inside a tenant. Previously issued access tokens may stay usable until they expire, and any credentials or permissions set up through separate identities need further review and remediation.
Scheduled backups are not running, and access to affected archives and restoration remains unavailable. ConnectWise said existing archives stay encrypted, isolated and preserved, with no evidence attackers breached or accessed them. SaaS Security and Cloud Management were also taken offline temporarily as a precaution.
ConnectWise said it spotted the issue on October 14, 2026, through cybersecurity monitoring and launched internal and external response actions. It has not seen successful threat activity in environments it monitors since the mitigations, though it noted it cannot directly observe downstream customer environments. Whether a product vulnerability played a role is still unclear, and the exact credential-exposure mechanism is under analysis.
The danger lies in abusing application credentials to reach customers' Microsoft 365 environments without stealing individual passwords. Because ConnectWise's applications hold broad permissions for backup and management, a stolen credential lets an attacker authenticate as the application, potentially reaching mailboxes, SharePoint documents, Teams messages and directory information, and adding the app to the Global Administrator role or planting client secrets for persistence.
Huntress told The Hacker News it last saw malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted manual activity running until about 14:20 UTC. The firm said it has high confidence the actor also targeted Cloud Management apps for Exchange Online, Teams and SharePoint, with abuse of the Teams app confirmed in one tenant, and that those apps did not appear to have been disabled.
Huntress reported a second targeted wave from IP address 144.172.64[.]128 on October 15 against 16 tenants in the policy, national security, trade and critical mineral sectors, all unsuccessful. It identified almost 1,000 Entra tenants with sign-in activity from the IP, 300 of which succeeded, though missing service principals in some tenants blocked access. Partners are advised to review their own and customer tenants, check sign-ins from October 13, 2026, preserve audit records, and inspect credentials, roles, consent grants and mailbox rules.
Source: The Hackers News