ConnectWise Disables Application Identities Following Targeted Exploitation of Microsoft 365 Environments

Huntress also expressed concern that other ConnectWise applications might still be at risk. The firm stated it has high confidence that the threat actor targeted Cloud Management apps for Exchange Online, Teams, and SharePoint, confirming at least one instance of abuse involving the Teams application. Because these specific applications were not initially included in the list of disabled identities, investigators are concerned that additional malicious activity could still occur.

Recommendations and Defensive Strategies

The incident serves as a stark reminder of the complexities involved in securing modern cloud ecosystems where third-party integrations are standard. Security experts are advising partners and customers to conduct thorough reviews of their environments to identify any unauthorized modifications.

The primary recommendation for administrators is to audit all application registrations and service principals within their Entra ID tenants. This includes looking for newly created applications, unexpected client secrets added to existing applications, or changes in permission levels—particularly the granting of high-privilege roles like Global Administrator or Application Administrator.

Huntress highlighted that several native Microsoft Entra controls can significantly limit the damage if an application credential is stolen. For instance, application management policies can be used to restrict or entirely block the use of client secrets on app registrations, or to cap the maximum lifetime of a credential, ensuring it cannot be used indefinitely.

Furthermore, limiting the number of users who hold the Application Administrator and Cloud Application Administrator roles reduces the number of accounts that have the power to add credentials to applications. For organizations with advanced licensing, Conditional Access for workload identities can be implemented. This allows administrators to restrict where an application is permitted to sign in from, such as limiting it to specific trusted IP ranges. Additionally, Microsoft Entra ID Protection can be configured to flag and automatically respond to risky service principals.

While these controls do not replace the need for regular manual reviews of credentials, they provide a layered defense that makes it much harder for a threat actor to use a stolen secret or to maintain a hidden presence within a compromised environment.

As the investigation continues, ConnectWise is expected to provide further updates on the restoration of its services and any additional findings regarding the source and methods of the attackers. For now, the focus remains on containment and assisting customers in securing their downstream environments against persistent threats.