Overview
- ConnectWise said it identified unauthorized access to seven application identities and disabled the affected app connections and revoked certificates on October 17, then suspended Cloud Backup, SaaS Security and Cloud Management while it investigates.
- Attackers stole ConnectWise application secrets and used them to impersonate vendor apps and request tokens from Microsoft Entra ID so they could access customer Microsoft 365 resources without needing user passwords or MFA.
- Security firm Huntress linked sign-ins from IP 144.172.64.128 to roughly 1,000 Entra tenants with about 300 successful sign-ins and reported a later, manual wave that targeted 16 sensitive-sector tenants.
- Responders warn the biggest remaining risk is in-tenant persistence because attackers can add client secrets, create applications, or grant directory roles including Global Administrator, actions that survive revoking the original vendor credential.
- ConnectWise and security firms urge customers to preserve sign-in and audit logs, keep affected app connections disabled, and audit service principals, consent grants, directory roles and mailbox rules because backups are paused and restores remain unavailable.