ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Incident Overview

ConnectWise has disabled seven ConnectWise application identities after unknown threat actors obtained unauthorized access to them and compromised Microsoft 365 tenants. The action, taken on October 17, 2026 at 07:00 UTC, covers identities linked to ConnectWise Cloud Backup and ConnectWise Cloud Management, including dedicated connections for MS Teams, Exchange Online, MS Graph, Partner Center, and SharePoint Online.

The company has suspended its Cloud Backup service by revoking certificates used for affected application connections across all users. Disabling the connections prevents new authentication through them, but it does not reverse changes previously made inside a tenant. Previously issued access tokens may remain usable until they expire or are otherwise invalidated. Any unauthorized credentials, permissions, or other access established through separate identities require additional review and remediation.

Service Impact and Investigation

Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. ConnectWise emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.

Out of an abundance of caution, the company temporarily took SaaS Security and Cloud Management offline while it completes its review. ConnectWise identified the issue on October 14, 2026 through its advanced cybersecurity monitoring and diligence, prompting it to activate internal and external incident investigation and response actions. The company said it has not observed successful threat activity in the environments it monitors since implementing mitigations, while cautioning that this does not establish the status of downstream customer environments, which it cannot directly observe.

Threat Activity and Recommendations

Huntress reported malicious sign-ins from the IP address 144.172.64[.]128, with the last observed sign-in from that address on October 15 at 08:45 UTC and targeted, manual activity continuing until about 14:20 UTC that day. The security firm said it has high confidence the threat actor also targeted the ConnectWise Cloud Management apps for Exchange Online, Microsoft Teams, and SharePoint, and confirmed abuse of the Teams app in one tenant. Those apps do not appear to have been disabled by ConnectWise, so additional activity could come from them.

Huntress identified almost 1,000 Entra tenants with sign-in activity from the IP address, out of which 300 succeeded. A second, targeted wave of attempts on October 15 singled out a narrow scope of 16 unsuccessful tenants in the policy, national security, trade, and critical mineral sectors. Partners are advised to review their own Microsoft 365 tenant and each managed customer tenant, including environments with dormant SkyKick connections; verify the status of the listed application connections; review sign-ins from October 13, 2026 onward from the IP address 144.172.64[.]128; preserve audit records before containment; and check for unauthorized mailbox forwarding, directory role changes, consent grants, and planted credentials such as client secrets added to other applications.

Sources: The Hacker News