Ethical Hacking News
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
A recent security breach has prompted ConnectWise to disable its cloud backup service and suspend Cloud Management, following an attack in which attackers compromised Microsoft 365 tenants. The company has temporarily taken certain SaaS Security and Cloud Management applications offline while it completes its review of the incident. The breach highlights the dangers of compromised application credentials and the potential for attackers to access customers' Microsoft 365 environments without having to steal each customer's password individually.
ConnectWise suspended its cloud backup service and disabled certain cloud management applications following a security breach on October 14, 2026.Attackers compromised Microsoft 365 tenants using compromised application credentials, gaining unauthorized access to customers' environments.The breach highlights the dangers of compromised application credentials and the need for robust cybersecurity measures.ConnectWise has taken measures to address the breach, including disabling affected connections and suspending cloud backup services.The company has preserved existing archives, which remain encrypted, isolated, and preserved, and have no evidence of being breached.Partners are advised to review their Microsoft 365 tenant, verify application connections, and preserve sign-in and audit records to address the breach.
ConnectWise has recently suspended its cloud backup service and disabled certain cloud management applications following a security breach in which attackers compromised Microsoft 365 tenants. The attack, which was identified on October 14, 2026, prompted the company to activate its internal and external incident investigation and response actions. The attackers were able to obtain unauthorized access to the application identities and compromised Microsoft 365 tenants, resulting in the suspension of cloud backup and cloud management services.
The breach highlighted the dangers of compromised application credentials, as the attackers were able to abuse the application's credentials to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker could request access tokens from Microsoft Entra ID based on the application's existing permissions.
Depending on the permissions assigned to the application, this could enable the attacker to potentially access other Microsoft services, including mailboxes, SharePoint documents, Teams messages, and directory information. The attackers were also able to add credentials to applications in Microsoft tenants, allowing them to keep access and act as the application. Huntress, a managed security service provider, has identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15, but there is no evidence that the stoppage was the result of public disclosure.
ConnectWise has taken several measures to address the breach, including disabling the affected connections and suspending cloud backup services. The company has also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.
Furthermore, the company has identified the issue on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting it to activate internal and external incident investigation and response actions. The company has also stated that it took the action on October 17, 2026, at 07:00 UTC, adding that the affected shared Cloud Backup credentials are no longer valid.
The breach highlights the importance of robust cybersecurity measures and the need for companies to regularly review and update their security protocols. ConnectWise's actions demonstrate the company's commitment to protecting its customers' data and preventing similar breaches in the future. Partners are advised to take several measures to address the breach, including reviewing their own Microsoft 365 tenant and each managed customer tenant, verifying the status of listed application connections, and preserving available sign-in and audit records before initiating containment steps.
In addition, the company has temporarily taken certain SaaS Security and Cloud Management applications offline while it completes its review of the incident. The company has also noted that there is no evidence that the stoppage was the result of public disclosure. The attackers were able to access customers' Microsoft 365 environments without having to steal each customer's password individually.
The breach also highlights the dangers of compromised application credentials and the potential for attackers to access customers' Microsoft 365 environments without having to steal each customer's password individually. By using the stolen application credential to authenticate as that application, the attacker could request access tokens from Microsoft Entra ID based on the application's existing permissions.
The attackers were able to add credentials to applications in Microsoft tenants, allowing them to keep access and act as the application. Huntress, a managed security service provider, has identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15, but there is no evidence that the stoppage was the result of public disclosure.
ConnectWise has taken several measures to address the breach, including disabling the affected connections and suspending cloud backup services. The company has also noted that scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable. However, it emphasized that existing archives remain encrypted, isolated, and preserved, and that there is no evidence they were breached or accessed by the attackers.
Furthermore, the company has identified the issue on October 14, 2026, through its "advanced cybersecurity monitoring and diligence," prompting it to activate internal and external incident investigation and response actions. The company has also stated that it took the action on October 17, 2026, at 07:00 UTC, adding that the affected shared Cloud Backup credentials are no longer valid.
The breach highlights the importance of robust cybersecurity measures and the need for companies to regularly review and update their security protocols. ConnectWise's actions demonstrate the company's commitment to protecting its customers' data and preventing similar breaches in the future. Partners are advised to take several measures to address the breach, including reviewing their own Microsoft 365 tenant and each managed customer tenant, verifying the status of listed application connections, and preserving available sign-in and audit records before initiating containment steps.
In conclusion, the recent breach of Microsoft 365 tenants by attackers who compromised ConnectWise's application identities highlights the dangers of compromised application credentials and the need for companies to regularly review and update their security protocols. ConnectWise's actions demonstrate the company's commitment to protecting its customers' data and preventing similar breaches in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/ConnectWise-Cloud-Backup-Suspended-Due-to-Microsoft-365-Tenant-Breach-ehn.shtml
https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
https://www.rescana.com/post/connectwise-cloud-backup-supply-chain-attack-analysis-of-microsoft-365-tenant-compromise-and-mitigation-strategies
Published: Sun Oct 18 03:55:39 2026 by llama3.2 3B Q4_K_M
