ConnectWise Cloud Backup Application Identities Compromised, Backdoored Entra Apps Seen in Microsoft 365 Tenants
ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended SaaS Security and Cloud Management as a precaution because both integrate with it. It has also reset accounts, replaced application credentials, strengthened administrative-access protections and engaged independent third-party incident responders. Huntress confirmed post-compromise activity in two Microsoft 365 tenants, where the application granted itself Global Administrator and planted new secrets on other applications for persistence. ConnectWise says it has seen no successful threat activity in the environments it monitors, and it has not established which partner or customer tenants are affected.
Technical Details
- Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. Only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-in activity. The address was used with a vendor credential and is the primary vector.
- Related addresses in the same provider range (AS14956, RouterHosting) showed password spray or failed logins, which Huntress considers unlikely to be related to the application sign-in activity: 144.172.64[.]99 (concentrated spray, October 10 to 14, 2026), 144.172.64[.]60 (a few failed logins, October 18) and 144.172.94[.]243 (broad, ongoing spray against many organizations).
- In the second compromised tenant, the application granted itself Global Administrator and added a new secret to a small number of other applications registered in the tenant. Huntress found no apparent selection logic: two different sets of applications were chosen in the two tenants, regardless of what those applications could do.
- Access may have been used for Microsoft Graph directory reads. There are no signs of mailbox or file manipulation, or of user or policy changes.
Remediation
- Do not reconnect affected applications until ConnectWise publishes formal restoration instructions.
- Review each potentially affected Microsoft 365 tenant. Preserve evidence, validate findings and assess operational impact before making changes.
- Use ConnectWise's published technical guidance to investigate partner and managed-customer environments. Look for unexpected Global Administrator grants and newly added application secrets.
- Hunt for sign-ins from the listed IP addresses. A clean result does not guarantee a tenant is unaffected.
Linha do tempo
-
ConnectWise Cloud Backup Application Identities Compromised, Backdoored Entra Apps Seen in Microsoft 365 Tenants
ler a análise desta fonte ocultar
ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended SaaS Security and Cloud Management as a precaution because both integrate with it. It has also reset accounts, replaced application credentials, strengthened administrative-access protections and engaged independent third-party incident responders. Huntress confirmed post-compromise activity in two Microsoft 365 tenants, where the application granted itself Global Administrator and planted new secrets on other applications for persistence. ConnectWise says it has seen no successful threat activity in the environments it monitors, and it has not established which partner or customer tenants are affected.
Technical Details
- Huntress reviewed application sign-ins across more than 10,000 tenants with ConnectWise applications. Only 144.172.64[.]128 and Microsoft-internal ranges produced application sign-in activity. The address was used with a vendor credential and is the primary vector.
- Related addresses in the same provider range (AS14956, RouterHosting) showed password spray or failed logins, which Huntress considers unlikely to be related to the application sign-in activity: 144.172.64[.]99 (concentrated spray, October 10 to 14, 2026), 144.172.64[.]60 (a few failed logins, October 18) and 144.172.94[.]243 (broad, ongoing spray against many organizations).
- In the second compromised tenant, the application granted itself Global Administrator and added a new secret to a small number of other applications registered in the tenant. Huntress found no apparent selection logic: two different sets of applications were chosen in the two tenants, regardless of what those applications could do.
- Access may have been used for Microsoft Graph directory reads. There are no signs of mailbox or file manipulation, or of user or policy changes.
Remediation
- Do not reconnect affected applications until ConnectWise publishes formal restoration instructions.
- Review each potentially affected Microsoft 365 tenant. Preserve evidence, validate findings and assess operational impact before making changes.
- Use ConnectWise's published technical guidance to investigate partner and managed-customer environments. Look for unexpected Global Administrator grants and newly added application secrets.
- Hunt for sign-ins from the listed IP addresses. A clean result does not guarantee a tenant is unaffected.