Ethical Hacking News
ConnectWise application credentials were stolen to target Microsoft 365, prompting the company to suspend cloud services. The attackers exploited the credentials to gain unauthorized access to sensitive data, highlighting the importance of secure application credentials and regular security audits. The incident also raises concerns about the operational risk for organizations that depend on ConnectWise Cloud Backup. Follow this link to read the full article and learn more about the incident and its implications.
ConnectWise suffered a sophisticated cyber attack, stealing application credentials to gain unauthorized access to Microsoft 365 tenants. The attackers exploited existing permissions to access sensitive data, including mailboxes, SharePoint documents, and Teams messages. The attack highlighted the importance of secure application credentials and regular security audits. The incident created operational risk for organizations relying on ConnectWise Cloud Backup, with backups unable to run. ConnectWise has taken protective action, including disabling affected connections, revoking certificates, and suspending Cloud Backup service. The incident serves as a reminder of the importance of cybersecurity and the need for organizations to prioritize security measures.
A sophisticated cyber attack has been discovered, where attackers have successfully stolen ConnectWise application credentials to gain unauthorized access to Microsoft 365 tenants. The incident has prompted ConnectWise to suspend its cloud services, including Cloud Backup and SaaS Security, after discovering the compromised identities on October 14.
The attackers took advantage of the fact that ConnectWise's applications already had permission to access customer Microsoft 365 environments to manage services and run backups. By stealing the application credentials, the attackers could pretend to be ConnectWise's own applications and request access tokens from Microsoft Entra ID. This allowed them to access sensitive data, including mailboxes, SharePoint documents, Teams messages, and directory data.
The attack is particularly complex because it highlights the importance of secure application credentials and the need for regular security audits. According to cybersecurity firm Huntress, the attackers could add their own client secret to a different trusted application already registered in the tenant, or create an entirely new application and grant it permissions. This would give them a second key that still works even after ConnectWise's original compromised credential is revoked.
The incident has also raised concerns about the operational risk for organizations that depend on ConnectWise Cloud Backup to recover their systems and information. The service remains offline, and backups cannot run, creating a risk for customers who rely on the service to recover their data.
ConnectWise has engaged a reputable third-party incident response firm to support their investigation and containment efforts. The company has taken protective action by disabling the affected connections, revoking certificates used for affected application connections, and suspending Cloud Backup service. The company has also recommended that users review their own Microsoft 365 tenant and every managed customer tenant, including any with dormant SkyKick connections.
The incident serves as a reminder of the importance of cybersecurity and the need for organizations to prioritize security measures, including regular security audits and secure application credentials. It also highlights the need for cybersecurity firms and organizations to stay vigilant and proactive in identifying and mitigating potential security threats.
Related Information:
https://www.ethicalhackingnews.com/articles/ConnectWise-Application-Credentials-Exploited-to-Target-Microsoft-365-A-Complex-Cyber-Attack-ehn.shtml
https://securityaffairs.com/201236/hacking/attackers-abuse-stolen-connectwise-application-credentials-to-target-microsoft-365.html
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
Published: Mon Oct 19 06:12:42 2026 by llama3.2 3B Q4_K_M
