ConnectWise disables 7 app identities after Microsoft 365 tenant breach

The latest:

Seven ConnectWise application identities were switched off at 07:00 UTC on October 17, 2026, after unknown threat actors used them to reach customers’ Microsoft 365 environments. The IT management software vendor also suspended its Cloud Backup service by revoking the certificates behind affected connections across all users, and took SaaS Security and Cloud Management offline while its review continues.

Details:

• The disabled identities: ConnectWise said the switched-off identities are Cloud Backup and six Cloud Management applications covering Microsoft Teams, Exchange Online, MS Graph, Partner Center and SharePoint Online. Each was published with its application ID so partners can match them against their own tenants.
• The limits of the fix: The company said disabling the connections blocks new authentication but does not reverse changes already made inside a tenant. Previously issued access tokens may stay usable until they expire, and unauthorized credentials created through separate identities need their own remediation.
• Backup impact: Scheduled backups are not running and access to affected archives and restoration is unavailable, according to ConnectWise. The company said existing archives remain encrypted, isolated and preserved, with no evidence attackers accessed them.
• The timeline: ConnectWise said it identified the issue on October 14, 2026, through its cybersecurity monitoring, then activated internal and external incident response. Mitigations followed three days later, on October 17.
• The attack mechanics: Because the applications hold broad permissions for backup and management work, a stolen credential lets an attacker authenticate as the application itself and request tokens from Microsoft Entra ID. That can open mailboxes, SharePoint documents, Teams messages and directory information without stealing any individual password.
• Persistence risk: Huntress said an attacker in that position can add the application to the Global Administrator role, add client secrets to other trusted applications, and create new applications with granted permissions. Those secrets provide a way back in even after the original credential is revoked.
• The scale: Huntress identified almost 1,000 Entra tenants with sign-in activity from the IP address tied to the unauthorized access, of which 300 succeeded. In some tenants the absence of a service principal blocked the attacker despite a successful sign-in.
• The second wave: Huntress reported a second, targeted wave from IP address 144.172.64.128 on October 15 against a narrow set of 16 tenants in the policy, national security, trade and critical mineral sectors. Those attempts were unsuccessful.
• Apps still live: Jon Semon, Principal Security Operations Analyst at Huntress, said the firm has high confidence the actor also targeted the Cloud Management apps for Exchange Online, Teams and SharePoint, and confirmed abuse of the Teams app in one tenant. He said those apps “do not appear to have been disabled by ConnectWise.”
• Open question: ConnectWise said it is unclear whether a product vulnerability contributed, and the exact credential-exposure mechanism is under analysis. It added it has seen no successful threat activity in monitored environments since the mitigations, while noting it cannot directly observe downstream customer environments. It advised partners to audit every managed tenant, including dormant SkyKick connections, review sign-ins from October 13 onward, and check for unauthorized mailbox forwarding.

Between the lines:

The containment is partial by design. ConnectWise concedes revoked connections do not undo in-tenant changes, and Huntress says credentials planted inside customer applications would survive the shutdown. Huntress also says the Exchange, Teams and SharePoint management apps it believes were targeted appear still enabled, which is why it describes further activity as possible rather than closed off.

What’s next

Watch for ConnectWise’s findings on whether a product flaw exposed the credentials, the restoration of Cloud Backup, SaaS Security and Cloud Management, and whether Huntress records malicious activity after October 15 from the named IP address.