ConnectWise Disables Application Identities Following Targeted Exploitation of Microsoft 365 Environments

ConnectWise, a leading provider of software for managed service providers (MSPs), has taken the significant step of disabling several application identities and suspending key services following an investigation into a sophisticated cyberattack. The incident, which involved unknown threat actors obtaining unauthorized access to application identities, has resulted in the compromise of multiple Microsoft 365 tenants belonging to ConnectWise customers.

The company announced on Saturday that it had disabled seven specific ConnectWise application identities as part of its ongoing mitigation strategy. This move, executed on October 17, 2026, at 07:00 UTC, was accompanied by the suspension of the ConnectWise Cloud Backup service. To ensure the security of its ecosystem, the company revoked certificates used for affected application connections across its entire user base.

According to the company’s security advisory, disabling these connections prevents new authentication attempts through the compromised identities. However, the company was careful to note that this action does not automatically reverse any malicious changes previously made within a customer’s tenant. The credentials associated with the shared Cloud Backup service are no longer valid, though previously issued access tokens may remain functional until they naturally expire or are manually invalidated by administrators.

The fallout of these defensive measures is significant for daily operations. ConnectWise confirmed that scheduled backups are currently not running, and access to backup archives and restoration capabilities is temporarily unavailable for affected users. Despite this disruption, the company emphasized that existing archives remain encrypted, isolated, and preserved. There is currently no evidence to suggest that the archives themselves were breached or that the attackers gained access to the stored data.

As a further precaution, ConnectWise has temporarily taken its SaaS Security and Cloud Management platforms offline. This "abundance of caution" approach allows the firm to complete a comprehensive review of the incident and ensure that no lingering vulnerabilities remain before restoring service.

The issue was first identified on October 14, 2026, through what ConnectWise described as advanced cybersecurity monitoring and internal diligence. The discovery prompted the immediate activation of both internal and external incident response teams. While the company stated that it has not observed further successful threat activity in the environments it directly monitors since implementing these mitigations, it acknowledged a blind spot regarding downstream customer environments, which are designed to be isolated from ConnectWise’s direct observation.

The Mechanics of Application Identity Compromise

The nature of this attack highlights a growing trend in the threat landscape where attackers move away from targeting individual user passwords and instead focus on the "identities" of the applications themselves. This method is particularly dangerous because it bypasses many traditional security hurdles.

In a typical environment, a management application like ConnectWise requires extensive permissions to perform its duties, such as backing up mailboxes, managing SharePoint documents, or overseeing Microsoft Teams communications. These permissions are granted through application identities—essentially non-human accounts—registered within Microsoft Entra ID (formerly Azure Active Directory).

By stealing the credentials or "client secrets" of these applications, an attacker can authenticate as the application itself. Once authenticated, the threat actor can request access tokens from Microsoft Entra ID based on the application’s existing high-level permissions. This allows the attacker to move laterally within a customer’s Microsoft 365 environment without ever needing to compromise a single user’s login credentials or bypass multi-factor authentication (MFA) assigned to human accounts.

The implications of such access are severe. Depending on the specific roles assigned to the application, a threat actor could potentially access sensitive directory information, read private emails, or download confidential documents. Furthermore, because these applications often operate with administrative-level privileges, attackers can expand their footprint by adding the compromised application to the Global Administrator role, creating new applications, or planting "client secrets" in other trusted applications. These planted secrets act as backdoors, providing a persistent means of re-entry even if the original compromised identity is discovered and revoked.

At this stage of the investigation, ConnectWise has not confirmed whether a specific product vulnerability was exploited to gain access to these identities. The exact mechanism of the credential exposure remains a primary focus of the ongoing forensic analysis.

Second, Targeted Wave of Attempts Observed

The investigation has been further complicated by evidence of a secondary, more focused phase of the attack. Cybersecurity firm Huntress, which has been closely monitoring the situation, reported that malicious sign-ins from the original attacker-controlled IP address were observed through October 15.

Jon Semon, a Principal Security Operations Analyst at Huntress, noted that while ConnectWise has shut off access to Cloud Backup, the risk remains if the threat actor successfully established persistence before the shutdown. If an attacker managed to add their own credentials to applications within a Microsoft tenant, those credentials would allow them to maintain access and continue acting with the authority of the application, regardless of ConnectWise’s global actions.

Huntress’s analysis revealed a "second, targeted wave of attempts" originating from the IP address 144.172.64[.]128 on October 15. Unlike the initial broad activity, this wave was highly specific, singling out a narrow scope of 16 tenants. These targets were not chosen at random; they operate within sensitive sectors including policy, national security, trade, and critical minerals.

The first sweep of this targeted wave occurred between 09:25 and 12:35 UTC, focusing on harvesting Graph tokens from the SkyKick application. A second sweep followed shortly after, between 13:54 and 14:20 UTC, which appeared to be a manual effort targeting a wide array of services, including Exchange Online, SharePoint Online, Teams, Azure Resource Manager, and the Office 365 Management APIs.

While these specific targeted attempts were reportedly unsuccessful, the scale of the broader campaign is notable. Huntress identified nearly 1,000 Entra tenants that experienced sign-in activity from the suspicious IP address. Of those, approximately 300 sign-ins were successful. In many cases, the absence of a specific service principal within the tenant prevented the threat actor from gaining deeper access, effectively acting as a structural barrier to the attack.

Huntress also expressed concern that other ConnectWise applications might still be at risk. The firm stated it has high confidence that the threat actor targeted Cloud Management apps for Exchange Online, Teams, and SharePoint, confirming at least one instance of abuse involving the Teams application. Because these specific applications were not initially included in the list of disabled identities, investigators are concerned that additional malicious activity could still occur.

Recommendations and Defensive Strategies

The incident serves as a stark reminder of the complexities involved in securing modern cloud ecosystems where third-party integrations are standard. Security experts are advising partners and customers to conduct thorough reviews of their environments to identify any unauthorized modifications.

The primary recommendation for administrators is to audit all application registrations and service principals within their Entra ID tenants. This includes looking for newly created applications, unexpected client secrets added to existing applications, or changes in permission levels—particularly the granting of high-privilege roles like Global Administrator or Application Administrator.

Huntress highlighted that several native Microsoft Entra controls can significantly limit the damage if an application credential is stolen. For instance, application management policies can be used to restrict or entirely block the use of client secrets on app registrations, or to cap the maximum lifetime of a credential, ensuring it cannot be used indefinitely.

Furthermore, limiting the number of users who hold the Application Administrator and Cloud Application Administrator roles reduces the number of accounts that have the power to add credentials to applications. For organizations with advanced licensing, Conditional Access for workload identities can be implemented. This allows administrators to restrict where an application is permitted to sign in from, such as limiting it to specific trusted IP ranges. Additionally, Microsoft Entra ID Protection can be configured to flag and automatically respond to risky service principals.

While these controls do not replace the need for regular manual reviews of credentials, they provide a layered defense that makes it much harder for a threat actor to use a stolen secret or to maintain a hidden presence within a compromised environment.

As the investigation continues, ConnectWise is expected to provide further updates on the restoration of its services and any additional findings regarding the source and methods of the attackers. For now, the focus remains on containment and assisting customers in securing their downstream environments against persistent threats.