ConnectWise disables 7 app identities and revokes Cloud Backup certificates after incident

The IT ConnectWise management software provider confirmed that on October 17, 2026, it disable seven application identities and revoked certificates related to its Cloud Backup service after detecting unauthorized access that allowed unknown actors to use these credentials to authenticate themselves to Microsoft 365 tenants. ConnectWise has temporarily suspended SaaS Security and Cloud Management services and has left the scheduled backups inoperative, although it claims that existing copy files remain encrypted, isolated and without evidence of malicious access so far.

Confirmed facts: ConnectWise disable the seven application identities listed by the company and revoked Cloud Backup certificates on October 17 at 07: 00 UTC; detected the incidence on October 14 by monitoring them; and stated that disablements prevent new authentication by these connections but do not reverse changes already made within a tenant. In addition, the company reported that it has not observed additional malicious activity in the environments it monitors since the implementation of its mitigation, although it admits that it cannot directly see the status of the downstream client environments.

Technical context and why this is serious: the applications registered in Microsoft Enter ID (formerly Azure AD) have credentials - whether customer secrets or certificates - that allow the application to request access tokens without the password of each user. If an actor gets one of these credentials, he can exchange it for tokens and act with the permissions that the application already has in a tenant. With the extensive capabilities that ConnectWise needs to manage and support environments (access to Exchange, SharePoint, Teams, Graph, etc.), the theft of a credential allows from reading of mailboxes and documents to creating new applications, adding secrets to existing applications and raising privileges by assigning roles or changes in directory configuration.

External research and known scope: the Huntress cybersecurity provider reported having observed session start-ups associated with an IP address linked to unauthorized activity, with almost 1,000 Entre tenants active from that IP and about 300 successful session start-ups. Huntress also points to targeted attempts on management applications at Exchange Online, Teams and SharePoint, and confirms abuse of the Teams app in at least one tenant. These data come from their analysis and do not represent a complete audit of all clients.

What is not yet clear: ConnectWise points out that the exact mechanism for the exposure of credentials is unknown and that it cannot at present state whether a product vulnerability contributed to the commitment. There is also no public and complete confirmation of which specific customers suffered persistent access or exfiltration; the company and third parties continue to investigate.

Practical implications for organizations and MSP: 1) temporary loss of ability to restore backups and breaks in scheduled copies; 2) risk of persistent unauthorized access within tenants if the actor added secrets or roles; 3) potential exposure of mail, files, chats and directory data according to permissions of the compromised applications. For regulated or high-risk sectors (national security, trade, etc.) exposure may involve regulatory non-compliance and mandatory notifications.

Immediate and concrete measures to be taken by managed managers and suppliers (priority by impact):

Preserve evidence: save sign-in and audit logs from Entering ID and Exchange from October 13 and beyond before making any disclosures.

Search for suspicious activity: review session start and audit events by looking for the reported IP (144.172.64.128) and other commitment indicators between October 13 and the current date; verify tokens issued and users or applications with unusual activity.

Auditing and containing application identities: list all the applications and service principals in each tenant, check owners, secrets and certificates with date of recent creation, and revoke or rotate unknown secrets. Keep the affected connections reported by ConnectWise disabled until further notification.

Check roles and permissions: audit assignments of privileged roles (Global Admin, Application Administrator, Cloud Application Administrator), reverse unauthorized changes and limit who can grant permission to applications. Review delegation consents and OAuth2PermissionGrants.

Find persistence and malicious behavior: check recent creation of applications, client secrets added, mail forwarding rules, transport rules and mailbox delegations; review policy creation / editing activities and changed owners.

Strengthening platform controls: apply application management policies that restrict customer secrets and limit their duration, consider Conditional Access for workload identities and enter ID Protection to mark risky principals. Microsoft publishes guides on application objects and service principals that help in these steps: App objects and service principals (Microsoft) and on labour-load identities: Workload identity federation (Microsoft).

Communicating and coordinating: MSP should immediately inform affected customers, share commitment indicators and collaborate in the review of their tenants. If there are suspicions of actual access or exfiltration, scale up incident response teams and inform the competent authorities according to the applicable regulation.

Medium-term mitigation recommendations: reduce privileges granted to applications (principle of less privilege), limit who can create or manage applications, apply consensus governance, rotate certificates and secrets with short cadences, and consider detection solutions that monitor unusual service activity principals. Microsoft Incoming protection tools and application management policies help to mitigate abuse if properly configured.

Conclusion: The display of application credentials is a vector that avoids the need to steal human credentials and facilitates escalation and persistence in multiple tenants. Acting fast in the preservation of evidence, review of service principals and revocation / rotation of credentials is essential, and organizations must assume that any application with comprehensive permits deserves a full audit until it is confirmed that there was no abuse. For technical documentation and specific identity management steps see the linked Microsoft guides and keep an eye on the official updates of ConnectWise at your warning and security center: ConnectWise Security Advisories.