ConnectWise Suspends Cloud Backup After Microsoft 365 Attacks

Managed service providers and enterprise administrators face an urgent identity audit after ConnectWise suspended its ConnectWise Cloud Backup service and revoked seven application identities on October 17, 2026. The emergency intervention followed the discovery that unauthorized threat actors obtained multi-tenant application credentials, allowing them to bypass user multi-factor authentication and compromise downstream Microsoft 365 customer tenants. ConnectWise confirmed that scheduled backups and restoration capabilities remain offline, while existing backup archives remain encrypted and isolated with no evidence of tampering or exfiltration.

Unauthorized access triggers Cloud Backup suspension

ConnectWise initiated containment measures on October 17 at 07:00 UTC by revoking the certificates used for affected multi-tenant application connections across its global partner base. The action immediately halted new authentication attempts through the compromised integration channels. According to a security advisory published on the ConnectWise Status portal, the vendor first detected anomalous activity on October 14 through its internal security monitoring systems.

Because the affected software relied on shared multi-tenant service principals, revoking the underlying credentials severed connectivity for seven critical application identities. ConnectWise also temporarily took its SaaS Security and Cloud Management platforms offline to conduct forensic reviews and ensure no secondary exposure pathways remained open.

The vendor emphasized that while disabling the application registrations blocks new sign-ins via those identities, it cannot roll back unauthorized configuration modifications previously executed within customer environments. Any previously generated access tokens may remain active until their scheduled expiration or manual revocation by tenant administrators.

How stolen application identities bypass MFA

The incident illustrates an acute operational risk inherent to cloud service provider integrations: workload identity abuse. Multi-tenant backup and administration platforms require broad application-level permissions across Exchange Online, SharePoint Online, Microsoft Teams, and Microsoft Graph to archive enterprise data automatically. These permissions operate outside user-level interactive sessions.

When adversaries acquire valid client secrets or certificates for a trusted service principal, they authenticate directly to Microsoft Entra ID. Because workload identities authenticate non-interactively without user credentials, standard user multi-factor authentication policies do not trigger. Once authenticated, the attacker obtains OAuth bearer tokens granting the full breadth of the application’s consented permissions.

Forensic telemetry indicates that the threat actors leveraged these permissions to establish persistent access. Intruders attempted to grant elevated roles, such as Global Administrator, generate new client secrets on existing enterprise applications, and register rogue service principals. Under this model, revoking the vendor’s original certificate stops the primary ingress but leaves attacker-created credentials functional until manually discovered and removed.

Threat scope and targeted tenant activity

Independent telemetry from cybersecurity firm Huntress revealed extensive reconnaissance and exploitation attempts originating from IP address 144.172.64.128. The activity was first observed on October 13, with active operations continuing through October 15 at 14:20 UTC. Huntress tracked sign-in activity against nearly 1,000 Microsoft Entra ID tenants, of which approximately 300 experienced successful authentications.

In tenants where the target service principal had not been previously provisioned or where SkyKick application registrations were absent, the sign-in attempts failed. However, Huntress observed confirmed abuse of the ConnectWise Microsoft Teams management application within at least one tenant.

Later on October 15, researchers identified a secondary, targeted wave of manual intrusions aimed at a narrow subset of 16 organizations across sensitive sectors, including national security, critical minerals, government policy, and international trade. This second wave included targeted sweeps for Microsoft Graph tokens associated with legacy SkyKick connections, followed by direct API requests against Exchange Online, Azure Resource Manager, and the Office 365 Management Activity API. Although these targeted attempts were unsuccessful, they demonstrate clear intent to extract strategic intelligence.

What happens next

ConnectWise stated that its forensic investigation into the exact credential-exposure mechanism remains ongoing, with external cybersecurity firms assisting in the analysis. The vendor has not yet confirmed whether an underlying software vulnerability facilitated the credential theft. ConnectWise reported that it has observed no further malicious activity within its directly monitored infrastructure since applying mitigations, but noted it cannot observe downstream customer tenant configurations.

Security leaders and managed service providers must treat affected Microsoft 365 environments as potentially compromised and execute immediate triage:

• Audit Entra ID logs: Review non-interactive sign-in logs and service principal activity originating from IP address 144.172.64.128 dating back to October 13, 2026.
• Disable affected integrations: Verify that all seven disabled ConnectWise application IDs and any dormant SkyKick registrations are disabled across every managed tenant.
• Inspect directory roles and credentials: Review all enterprise applications and app registrations for recently created client secrets, newly added owners, or unapproved consent grants.
• Revoke active sessions: Invalidate existing OAuth tokens and reset sessions for privileged roles across suspected tenants.
• Check messaging rules: Audit Exchange Online transport rules, automated mailbox forwarding configurations, and delegated permissions for signs of data exfiltration conduits.
• Enforce workload identity controls: Deploy Microsoft Entra Conditional Access policies for workload identities to restrict service principal authentications by trusted IP ranges and monitor risky service principals via Entra ID Protection.

ConnectWise has committed to providing operational updates as restoration timelines and root-cause findings are established. In the interim, backup operations remain halted, requiring organizations to evaluate alternative continuity safeguards.