Full Report
Huntress alleges takeover of M365 accounts
Analysis Summary
# Incident Report: ConnectWise Cloud Backup Compromise and Alleged M365 Account Takeover
## Executive Summary
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after detecting unauthorized access to application identities in the Cloud Backup environment. Huntress reports that a compromised Microsoft 365 API secret belonging to ConnectWise Cloud Backup was used to access customer M365 tenants, including one in which a ConnectWise application granted itself Global Administrator. As of October 18, 2026, the services remained unavailable, and the full scope of customer impact had not been confirmed.
## Incident Details
- **Discovery Date:** Identified on October 15, 2026; publicly disclosed in an advisory on October 16, 2026
- **Incident Date:** Not disclosed. The article does not state when the unauthorized access began.
- **Affected Organization:** ConnectWise (Cloud Backup, formerly SkyKick; SaaS Security; Cloud Management). Downstream impact extends to MSPs and their end-user customers.
- **Sector:** Managed service provider (MSP) technology / SaaS platform vendor
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Not disclosed. Detection occurred on October 15, 2026.
- **Vector:** Unauthorized access to application identities within the ConnectWise Cloud Backup environment. Huntress attributes this to a compromised Microsoft 365 API secret (credential) belonging to Cloud Backup.
- **Details:** ConnectWise has not publicly confirmed the initial access method. Its advisory references indicators of compromise tied to a handful of IP addresses and third-party app integrations, but the article does not list them.
### Lateral Movement
- A second ConnectWise application, "ConnectWise Cloud Management - MS Teams" (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), was used in at least one Huntress partner tenant. It granted itself Global Administrator and then added new credentials to two other applications in that tenant, one of which was a single-tenant Huntress application unique to that partner.
- Movement appears to have occurred through application identities rather than user accounts.
### Data Exfiltration/Impact
- **Service impact:** Cloud Backup is unavailable as of 16:00 UTC on October 18. Customers cannot back up data, access archives, or restore data.
- **Data impact:** ConnectWise states that existing archives "remain encrypted, isolated, and preserved, with no evidence of unauthorized access." The article does not confirm whether any customer data was accessed or exfiltrated.
- **Tenant impact:** Huntress confirmed unauthorized access to customer M365 environments, though the number of affected tenants is not stated.
### Detection & Response
- **Detection:** ConnectWise detected unauthorized access on October 15, 2026.
- **Response actions:**
- Suspended Cloud Backup, SaaS Security, and Cloud Management services "out of an abundance of caution"
- Disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and ConnectWise products
- Published indicators of compromise, including IP addresses and third-party app integrations
- Published a public advisory (October 16) and posted updates on Reddit
- Asked MSPs to review M365 environments they manage for signs of compromise
- **Huntress:** Publicly reported the compromised API secret and the abused applications, and warned that disabling apps does not remove credentials already added.
## Attack Methodology
- **Initial Access:** Compromised Microsoft 365 API secret (application credential) belonging to ConnectWise Cloud Backup
- **Persistence:** Credentials added to other M365 applications in affected tenants, including a Huntress single-tenant application. These persist even after the abused apps are disabled.
- **Privilege Escalation:** The ConnectWise Cloud Management - MS Teams application granted itself Global Administrator in at least one tenant.
- **Defense Evasion:** Not described in the article.
- **Credential Access:** Theft or compromise of a Microsoft 365 API secret. The method of theft is not disclosed.
- **Discovery:** Not described in the article.
- **Lateral Movement:** Abuse of trusted, cross-tenant integrations and application identities to move into other applications within customer tenants
- **Collection:** Not described in the article.
- **Exfiltration:** Not confirmed in the article.
- **Impact:** Loss of service availability for Cloud Backup and related services; unauthorized access to customer M365 tenants alleged by Huntress.
## Impact Assessment
- **Financial:** Not disclosed
- **Data Breach:** Not confirmed. ConnectWise reports no evidence of unauthorized access to archives. Huntress reports unauthorized access to customer M365 environments, and the data types and volume are unknown.
- **Operational:** Customers and MSPs cannot back up, restore, or access archived data. Integrations with Exchange, Teams, and SharePoint Online are disabled. The outage was ongoing as of October 18.
- **Reputational:** Significant. The article compares the risk to the 2021 incident involving a remote management platform used by MSPs, and notes that vendors serving MSPs are frequent targets because a single compromise can reach many downstream customers.
## Indicators of Compromise
- **Network indicators:** IP addresses tied to the incident were published by ConnectWise but are not listed in the article. Defang any IPs when obtained (e.g., 192[.]0[.]2[.]1).
- **Application indicators:**
- Application ID 24205314-2b89-4e07-a2a4-579e898a5640 (ConnectWise Cloud Management - MS Teams)
- Cloud Backup application identities (IDs not provided)
- Third-party app integrations (specifics not provided)
- **Behavioral indicators:**
- An application granting itself Global Administrator
- New credentials added to existing applications, especially single-tenant apps
- Unexpected application credential additions after the initial compromise
- Abnormal use of API secrets from unfamiliar IP addresses
## Response Actions
- **Containment:**
- Suspended Cloud Backup, SaaS Security, and Cloud Management services
- Disabled integrations with Exchange, Teams, SharePoint Online, and ConnectWise products
- **Eradication:**
- Ongoing forensic analysis and threat hunting by ConnectWise
- Remediation activities in progress (details not disclosed)
- Huntress advises removing credentials that were already added, not just disabling apps
- **Recovery:**
- Services remained unavailable as of October 18
- Customers were advised to review all M365 applications and credentials in their tenants
- MSPs were asked to check their managed M365 environments for compromise
## Lessons Learned
- **Key takeaways:**
- A single compromised vendor API secret can give attackers access to many downstream customer tenants.
- Disabling a malicious application does not revoke credentials it has already added to other applications, so persistence can survive containment.
- Applications with high privileges, such as the ability to grant Global Administrator, are a significant risk and need strict controls.
- Vendors and MSPs may not know which tenants they touch, and end customers may not know which vendors support their environment. This creates visibility gaps during incidents.
- **What could have been done better:**
- Limit the permissions of integration apps so they cannot grant themselves higher privileges.
- Rotate and protect API secrets, ideally using certificates or managed identities instead of long-lived client secrets.
- Monitor for new credential additions and role assignments on service principals.
- Give customers earlier and more specific guidance on which tenants and apps to review.
## Recommendations
- **Credential hygiene:** Rotate all ConnectWise-related and third-party application secrets. Prefer certificate-based or federated credentials over client secrets.
- **Application review:** Audit all enterprise and app registrations in Entra ID. Remove unrecognized credentials, especially on single-tenant and high-privilege apps. Review OAuth consent grants and app permissions.
- **Privilege controls:** Restrict who can assign directory roles such as Global Administrator. Alert on any service principal receiving privileged roles. Use Privileged Identity Management with approval workflows.
- **Monitoring:** Enable and review Entra ID audit logs for "Add service principal credentials," "Add application," and role assignment events. Alert on sign-ins from unexpected IP addresses using service principals.
- **Vendor risk:** Inventory third-party integrations and their permissions. Require vendors to disclose their use of tenant-level app access and their incident notification procedures.
- **Incident readiness:** Maintain an up-to-date list of MSP and SaaS tools with access to your tenant, and define a process for responding to vendor-side compromises, including backup continuity planning for when a backup service is unavailable.