Overview
- Security firms and Microsoft, which detected the activity on Thursday, identified scripted sign-ins from IP 144.172.64.128 that succeeded in roughly 162 to 173 Microsoft 365 tenants where the ConnectWise Cloud Backup app was consented.
- The attacker authenticated directly as the ConnectWise backup application using its secret to request Microsoft Graph tokens, which inherit the app’s pre‑granted rights and bypass user multi‑factor protections.
- Those inherited permissions can let an intruder read and write mail, OneDrive and SharePoint files, Teams chats, and directory data, and in some tenants the attacker used the app to grant elevated roles and add new credentials to other applications.
- ConnectWise has disabled seven affected application identities, suspended Cloud Backup access, and revoked certificates while Microsoft and responders published indicators and urged administrators to disable implicated apps, audit service principal sign‑ins, and rotate or revoke app secrets because issued tokens may remain valid for a short window.
- ConnectWise says it has no evidence that stored backup archives were accessed, but MSPs and customers face service disruption and must check for added secrets, role changes, mailbox rules, and other persistence to limit ongoing exposure and restore trust in vendor app access controls.