ConnectWise suspends Cloud services after credential compromise

On October 17, 2026, ConnectWise took its Cloud Backup, SaaS Security, and Cloud Management services offline after detecting unauthorized access to application identities in its Cloud Backup environment. The suspension was a protective measure to prevent further unauthorized access to customer environments. The company disabled seven application identities that same day, including Cloud Backup, Cloud Management, and related Microsoft Teams, Exchange Online, and SharePoint Online apps. Disabling these identities stops new authentication but does not undo changes already made inside customer tenants.

Starting October 15, 2026, attackers used a compromised credential from ConnectWise’s Cloud Backup service to access Microsoft 365 tenants, affecting 162 organizations between October 15 and 16. The credential was a client assertion, a credential that proves the application’s identity, tied to ConnectWise’s own tenant, not a credential specific to any customer. ConnectWise detected the suspicious activity on October 14, 2026, and immediately began investigating, activating internal and external incident response actions. Since implementing mitigations, the company has not observed successful threat activity in monitored environments.

By October 17, 2026, Huntress had tracked sign-in attempts from the attacker’s IP address (144.172.64[.]128) across nearly 1,000 Microsoft Entra tenants, with over 300 of them successful. A successful sign-in did not guarantee access, depending on whether the ConnectWise service principal, the application’s identity in a tenant, was present. Huntress also observed attackers moving through Microsoft 365 tenants in sorted GUID orders, which indicated scripted, automated access. This pattern suggested the attackers were working from a pre-defined target list.

On October 15, 2026, attackers used the compromised credential to add themselves to the Global Administrator role in at least one customer tenant. With this elevated access, attackers could modify permissions for other applications, including Huntress’s own security app. Microsoft confirmed that threat actors likely abused permissions that customers had granted to the ConnectWise application, including highly elevated permissions like Directory.ReadWrite.All. This abuse gave attackers broad access to customer environments.

A second wave of attacks on October 15, 2026, targeted 16 tenants in policy, national security, trade, and critical mineral sectors, but Huntress reported these attempts were unsuccessful. The attackers targeted Microsoft Graph tokens and other services, but the absence of ConnectWise service principals in these tenants prevented access.

On October 17, 2026, ConnectWise revoked certificates for affected application connections, which rendered previously issued access tokens invalid over time. The revocation does not remove unauthorized credentials or permissions that attackers established separately. Through downstream security monitoring, ConnectWise identified two additional malicious IP addresses (144.172.64[.]99 and 144.172.64[.]60) linked to the attack. ConnectWise discovered these IPs during the investigation and shared them with partners for awareness.

ConnectWise has found no evidence that attackers accessed or compromised backup data, which remains encrypted and stored separately. ConnectWise has not named a specific threat actor, focusing instead on investigation, remediation, and supporting affected partners.

The Cloud Backup service, formerly known as SkyKick, is widely used by managed service providers (MSPs) to protect Microsoft 365 and Google Workspace data. The service relies on Azure Enterprise applications, applications registered in Azure that organizations grant access to. Partners grant access to the application, which then generates credentials for Microsoft 365 authentication. The compromised credential let attackers authenticate as the application itself, which gave them access to customer environments.

David Raissipour, ConnectWise’s CTO, stated that the company had not seen suspicious activity in its environment for over 24 hours as of October 19, 2026. Raissipour emphasized that the company is prioritizing security validation before restoring services. ConnectWise has not set a timeline for restoring services, citing ongoing investigation and remediation efforts. The Cloud Backup service has over 4,000 Azure services that require restoration, including certificate rotation and environment cleaning.

The restoration process involves ensuring a secure environment before bringing services back online.

ConnectWise recommends that customers review Microsoft 365 tenant configurations, sign-in logs, and application permissions for suspicious activity from October 13, 2026, onward. ConnectWise urges customers to preserve audit records and investigate unauthorized mailbox forwarding or delegated access.

The incident underscores the systemic risks faced by managed service providers (MSPs), which rely on third-party tools with broad permissions. A single compromised vendor credential can grant attackers access to multiple customer environments, highlighting the need for robust supply chain security.