ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise disabled seven application identities linked to its cloud backup and management products. These identities could authenticate to customer Microsoft 365 environments. The company acted after unknown attackers gained unauthorized access and compromised tenants. The goal was to prevent further authentication through the affected connections.

The disabled identities included Cloud Backup and Cloud Management identities for Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. ConnectWise also revoked certificates used for affected Cloud Backup connections across all users. That action suspended scheduled backups and blocked access to backup archives and restoration features.

ConnectWise said existing archives remain encrypted, isolated, and preserved, with no evidence of attacker access. It temporarily took SaaS Security and Cloud Management offline. The company warned that disabling connections does not undo earlier tenant changes or address access created through separate identities.

A Microsoft 365 application identity is a software identity with assigned permissions inside a customer tenant. It allows a service such as ConnectWise Cloud Management to authenticate and perform approved tasks. This matters because the identity can represent the application across connected Microsoft services, rather than representing one named employee.

An attacker who obtains the application credential can authenticate as that application. Microsoft Entra ID can then issue access tokens based on the application's existing permissions. Depending on those permissions, the attacker may reach mailboxes, SharePoint documents, Teams messages, directory information, or other services.

The attacker therefore does not need to steal every customer's password individually. ConnectWise said its applications had extensive permissions for backup and management work. The exact credential-exposure mechanism remains under analysis, and the article does not establish whether a product vulnerability contributed.

The requested tenant counts are not provided in the supplied article text. The article discusses malicious sign-ins from an original address and describes a later targeted wave of attempts, but it gives no total number of affected or targeted Microsoft Entra tenants.

It does provide timing. Huntress said malicious sign-ins from the original address were last observed on October 15 at 08:45 UTC. Targeted, manual activity continued until about 14:20 UTC that day. Huntress also confirmed abuse of the Teams application in one tenant.

Huntress said it had not identified new malicious activity since October 15. However, the text does not say how many tenants showed activity from the suspicious IP address or how many were targeted in the second wave. Any numerical answer would go beyond the supplied source.

The danger came from the ConnectWise applications' extensive permissions for backup and management tasks. Once attackers authenticated as an application, they could potentially use those permissions across multiple Microsoft services. This created a broader risk than a single stolen user password.

Depending on assigned permissions, attackers could access Exchange Online mailboxes, SharePoint documents, Teams messages, and directory information. The article also describes more serious tenant changes. Attackers could add the application to the Global Administrator role, add client secrets to trusted applications, create new applications, and grant those applications permissions.

These changes could support persistence and wider access. ConnectWise disabled affected connections, but said that action does not reverse changes already made inside a tenant. It also warned that unauthorized credentials, permissions, or access established through separate identities require additional review and remediation.

Disabling an application connection prevents Microsoft Entra ID from accepting new authentication through that specific connection. Revoking Cloud Backup certificates makes the shared credentials invalid for future use. These measures cut off the original route rather than rewinding activity that already occurred inside a tenant.

ConnectWise explicitly warned that previously issued access tokens may remain usable until they expire or are otherwise invalidated. The article also says separate identities may have been used to establish unauthorized credentials, permissions, or access. Those routes require their own review and remediation.

This is why disabling the seven identities is not the same as cleaning every affected tenant. Existing changes, such as elevated roles or added application secrets, can remain. ConnectWise said it had not observed successful threat activity in environments it monitors after mitigation, but it could not directly observe downstream customer environments.

Client secrets and newly created applications can provide alternative ways to authenticate after the original stolen credential is revoked. This matters because disabling one ConnectWise identity may not remove access that attackers deliberately established inside a customer tenant.

The article describes several methods. Attackers could add the ConnectWise application to the Global Administrator role, add client secrets to other trusted applications, or create new applications and grant them permissions. A client secret can then authenticate as its associated application. The compromised application could also use elevated permissions to support further changes.

These routes create persistence. Huntress warned that credentials added to applications in Microsoft tenants could let attackers keep access and act as the application. ConnectWise therefore said unauthorized credentials, permissions, or access through separate identities require additional review and remediation, even after affected connections are disabled.

Microsoft Entra ID acts as the identity and token service described in the article. An application presents its credentials to authenticate as itself. Entra ID then bases the requested token on permissions assigned to that application in the customer tenant. The token represents the application's approved access.

For example, a ConnectWise identity with permissions for Exchange Online, Teams, SharePoint Online, or Microsoft Graph could request tokens for those services. The resulting access could include mailboxes, Teams messages, SharePoint documents, or directory information, depending on the permissions. The article says attackers abused this application-based path.

The model explains why one exposed credential could affect multiple tenants without stealing individual passwords. It also explains the danger of added roles, secrets, and applications: those changes can expand what future tokens authorize. The article does not provide a complete permission list for every ConnectWise identity.