ConnectWise Disables Application Identities Following Targeted Exploitation of Microsoft 365 Environments

By stealing the credentials or "client secrets" of these applications, an attacker can authenticate as the application itself. Once authenticated, the threat actor can request access tokens from Microsoft Entra ID based on the application’s existing high-level permissions. This allows the attacker to move laterally within a customer’s Microsoft 365 environment without ever needing to compromise a single user’s login credentials or bypass multi-factor authentication (MFA) assigned to human accounts.

The implications of such access are severe. Depending on the specific roles assigned to the application, a threat actor could potentially access sensitive directory information, read private emails, or download confidential documents. Furthermore, because these applications often operate with administrative-level privileges, attackers can expand their footprint by adding the compromised application to the Global Administrator role, creating new applications, or planting "client secrets" in other trusted applications. These planted secrets act as backdoors, providing a persistent means of re-entry even if the original compromised identity is discovered and revoked.

At this stage of the investigation, ConnectWise has not confirmed whether a specific product vulnerability was exploited to gain access to these identities. The exact mechanism of the credential exposure remains a primary focus of the ongoing forensic analysis.

Second, Targeted Wave of Attempts Observed

The investigation has been further complicated by evidence of a secondary, more focused phase of the attack. Cybersecurity firm Huntress, which has been closely monitoring the situation, reported that malicious sign-ins from the original attacker-controlled IP address were observed through October 15.

Jon Semon, a Principal Security Operations Analyst at Huntress, noted that while ConnectWise has shut off access to Cloud Backup, the risk remains if the threat actor successfully established persistence before the shutdown. If an attacker managed to add their own credentials to applications within a Microsoft tenant, those credentials would allow them to maintain access and continue acting with the authority of the application, regardless of ConnectWise’s global actions.

Huntress’s analysis revealed a "second, targeted wave of attempts" originating from the IP address 144.172.64[.]128 on October 15. Unlike the initial broad activity, this wave was highly specific, singling out a narrow scope of 16 tenants. These targets were not chosen at random; they operate within sensitive sectors including policy, national security, trade, and critical minerals.

The first sweep of this targeted wave occurred between 09:25 and 12:35 UTC, focusing on harvesting Graph tokens from the SkyKick application. A second sweep followed shortly after, between 13:54 and 14:20 UTC, which appeared to be a manual effort targeting a wide array of services, including Exchange Online, SharePoint Online, Teams, Azure Resource Manager, and the Office 365 Management APIs.

While these specific targeted attempts were reportedly unsuccessful, the scale of the broader campaign is notable. Huntress identified nearly 1,000 Entra tenants that experienced sign-in activity from the suspicious IP address. Of those, approximately 300 sign-ins were successful. In many cases, the absence of a specific service principal within the tenant prevented the threat actor from gaining deeper access, effectively acting as a structural barrier to the attack.