Full Report
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
Analysis Summary
# Incident Report: ConnectWise Application Identity Compromise Leads to Microsoft 365 Tenant Access
> **Source note:** The article excerpt is truncated. Sections on the initial credential-theft mechanism, the full threat-actor activity, and attacker tooling are incomplete or unavailable. Items marked "Not disclosed" were not in the provided text.
## Executive Summary
Unknown threat actors obtained unauthorized access to several ConnectWise application identities and used them to compromise customers' Microsoft 365 tenants. ConnectWise identified the issue on October 14, 2026, disabled seven application identities on October 17, and suspended its Cloud Backup service and temporarily took SaaS Security and Cloud Management offline. The company says disabling the identities stops new authentication through them but does not reverse changes already made inside affected tenants.
## Incident Details
- **Discovery Date:** October 14, 2026 (identified through ConnectWise's "advanced cybersecurity monitoring and diligence")
- **Incident Date:** Not fully disclosed. Malicious sign-ins from the original source were last observed October 15, 2026, at 08:45 UTC, with targeted manual activity continuing until about 14:20 UTC.
- **Affected Organization:** ConnectWise (IT management software provider) and downstream customers with Microsoft 365 tenants connected to its applications
- **Sector:** IT management / managed service provider (MSP) software and SaaS
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Exact start date not disclosed. Activity was identified by October 14, 2026.
- **Vector:** Unauthorized access to ConnectWise application identities (service principals) in Microsoft Entra ID. The article notes that it is unclear whether a product vulnerability contributed.
- **Details:** Threat actors obtained application credentials. The exact credential-exposure mechanism is still under analysis. Using these credentials, an attacker can authenticate as the application and request access tokens based on its permissions, without needing individual user passwords.
### Lateral Movement
- **Cross-tenant movement:** The shared application identities provided access across multiple customer Microsoft 365 tenants.
- **Within-tenant expansion (possible, per article):** The article describes how an attacker could:
- Add the compromised application to the Global Administrator role
- Add client secrets to other trusted applications in the tenant
- Create new applications and grant them permissions
- **Confirmed use:** Not specified in the excerpt.
### Data Exfiltration/Impact
- **Tenant changes:** Unauthorized changes were made inside affected tenants. ConnectWise states these are not reversed by disabling the identities.
- **Potentially reachable data:** Depending on permissions, mailboxes, SharePoint documents, Teams messages, and directory information.
- **Backup archives:** ConnectWise states there is no evidence that encrypted backup archives were breached or accessed.
- **Confirmed data theft:** Not disclosed in the excerpt.
### Detection & Response
- **Detection:** ConnectWise identified the issue on October 14, 2026, through internal advanced monitoring.
- **Response:**
- Activated internal and external incident investigation and response
- Disabled seven application identities on October 17, 2026, at 07:00 UTC
- Revoked certificates used for affected application connections across all users
- Suspended the Cloud Backup service
- Temporarily took SaaS Security and Cloud Management offline
- Published advisories and status updates
## Attack Methodology
- **Initial Access:** Compromise of application identity credentials (service principal secrets/certificates). Specific theft method not disclosed.
- **Persistence:** Potential use of client secrets on other trusted applications and newly created applications, which would allow access even after the original credential is revoked. Confirmed use not disclosed.
- **Privilege Escalation:** Possible addition of the compromised application to the Global Administrator role, based on the high permissions of ConnectWise applications.
- **Defense Evasion:** Not disclosed.
- **Credential Access:** Theft of application credentials. Access tokens from Microsoft Entra ID could be requested using these credentials.
- **Discovery:** Not disclosed. Huntress observed "targeted, manual activity," suggesting hands-on-keyboard reconnaissance.
- **Lateral Movement:** Movement across tenants via shared application identities. Within-tenant movement via app role changes and new app creation (possible).
- **Collection:** Not disclosed. Potentially mailboxes, SharePoint, Teams, and directory data depending on permissions.
- **Exfiltration:** Not disclosed.
- **Impact:** Unauthorized access and changes in customer Microsoft 365 tenants. Backup operations were disrupted.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential exposure of mailboxes, SharePoint documents, Teams messages, and directory information in affected tenants. Scope not quantified. ConnectWise states that backup archives remain encrypted and unbreached.
- **Operational:**
- Scheduled backups halted
- Access to backup archives and restoration capabilities unavailable
- SaaS Security and Cloud Management temporarily offline
- **Reputational:** Public disclosure of a supply-chain-style compromise affecting an IT management vendor and its customers' cloud environments.
## Indicators of Compromise
**Compromised / Disabled Application Identities (Application IDs):**
- ConnectWise Cloud Backup: `506e08f9-6e9a-4da4-942b-a099a03644ae`
- ConnectWise Cloud Management: `2399d300-6fca-4e6a-a686-399fefe75b83`
- ConnectWise Cloud Management - MS Teams: `24205314-2b89-4e07-a2a4-579e898a5640`
- ConnectWise Cloud Management - Exchange Online: `b78f6a77-d4e5-46fb-87e5-d1648bd02519`
- ConnectWise Cloud Management - MS Graph: `0de14c77-b9b0-4137-9360-34878a929827`
- ConnectWise Cloud Management - Partner Center: `412dcf96-176d-4b3a-a1b0-4981ad66971e`
- ConnectWise Cloud Management - SharePoint Online: `b2b55f5b-7758-4719-8d8f-88ae172e6bdb`
**Network Indicators:**
- Source IP/address of malicious sign-ins: Referenced by the article but not included in the excerpt. Defang any IPs when obtained (e.g., `192[.]0[.]2[.]x`).
- Reference advisory: hxxps://status[.]connectwise[.]com/pages/incident/619cf82551fec9053d612f09/6ad263692dc48705ab3da2cb
**File Indicators:** None disclosed.
**Behavioral Indicators:**
- Sign-ins using ConnectWise application identities from unfamiliar sources
- Manual (non-automated) activity under application identities
- New client secrets or certificates added to existing applications
- New application registrations with broad Microsoft Graph or Exchange permissions
- Application assignment to the Global Administrator role
- Activity in Microsoft Entra ID audit logs related to service principals
## Response Actions
**Containment:**
- Disabled seven ConnectWise application identities (October 17, 2026, 07:00 UTC)
- Revoked certificates for affected application connections across all users
- Suspended Cloud Backup service
- Temporarily took SaaS Security and Cloud Management offline
**Eradication:**
- ConnectWise is reviewing and analyzing the credential-exposure mechanism
- Review and remediation of "unauthorized credentials, permissions, or other access established through separate identities" (per ConnectWise)
**Recovery:**
- Backup restoration unavailable while the review continues
- Ongoing investigation with external responders
- Status and advisory updates published
## Lessons Learned
- **Shared, high-privilege application identities are high-value targets.** A single compromised identity can reach many customer tenants.
- **Disabling an identity does not undo damage.** Tenant changes, new credentials, and new applications persist after containment.
- **Previously issued access tokens remain valid** until expiry or explicit invalidation. Containment must include token revocation.
- **Vendors cannot fully see downstream customer environments.** ConnectWise states it "cannot directly observe" customer status.
- **Detection occurred through vendor-side monitoring** and was disclosed roughly four days after identification, with containment on October 17.
- **Possible improvements:** Stronger credential protection for shared service identities, tighter scoping of application permissions (least privilege), and automated alerting on service principal changes and privilege escalation.
## Recommendations
**For customers and administrators of affected environments:**
- Inventory all ConnectWise application registrations and enterprise applications in Microsoft Entra ID, and compare them against the list above.
- Review Entra ID sign-in and audit logs for activity from the listed application IDs, especially from October 14–17, 2026.
- Revoke all sessions and tokens for affected applications. Disabling is not enough, because issued tokens may remain valid.
- Rotate or remove all client secrets and certificates on affected and related applications.
- Audit Global Administrator and other privileged role memberships for unexpected additions.
- Review app role assignments, OAuth consent grants, and newly created applications for unauthorized permissions.
- Check for unexpected changes in mailbox rules, SharePoint sharing settings, Teams configurations, and directory objects.
- Review your MSP/vendor access model and confirm which vendor identities have standing access to your tenant.
**General prevention for similar incidents:**
- Use managed identities or certificate-based authentication with short-lived credentials instead of long-lived client secrets where possible.
- Apply least-privilege permissions to all third-party and vendor applications.
- Require admin consent workflows and regularly review granted permissions.
- Enable Conditional Access policies for workload identities where supported.
- Monitor Entra ID for service principal credential additions and Global Administrator role assignments, with alerts.
- Maintain an inventory of third-party applications with tenant access and review it periodically.
- Include vendor-compromise scenarios in incident response plans, including token revocation procedures.