Supply Chain Attack on ConnectWise Cloud Backup Compromises 173 Microsoft 365 Tenants
On October 15, 2026, threat actors exploited a stolen ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 partner and customer tenants, leveraging a trusted multitenant backup application with broad permissions. The attack, confirmed by Microsoft Threat Intelligence and Huntress, highlights the risks of compromised vendor secrets in supply chain breaches.
The attackers used a compromised API secret from ConnectWise’s home tenant to authenticate via the ConnectWise Cloud Backup OAuth app (AppID: 506e08f9-6e9a-4da4-942b-a099a03644ae), bypassing traditional authentication methods like passwords or MFA. Between 06:13 and 08:34 UTC, the threat actor accessed tenants from the IP 144.172.64[.]128, using an automated script to cycle through targets in rapid succession.
In one case, a second app ConnectWise Cloud Management – MS Teams (AppID: 24205314-2b89-4e07-a2a4-579e898a5640) escalated privileges by assigning itself the Global Administrator role. The attacker then added persistent client secrets to other trusted applications, set to expire in 2028, ensuring long-term access even if the original apps were disabled.
Microsoft’s sign-in logs revealed connections from the private IPv6 range fde4:8dba:2600:37ce:6d26:200:a76:*, though Huntress noted this range may also host legitimate traffic. Observed user agents included Python-urllib/3.12 and python-requests/2.31, though these alone are not definitive indicators of compromise.
ConnectWise confirmed containment measures were in place and stated there was no evidence of backup data access at the time of disclosure. However, defenders are advised to review Microsoft Entra audit logs for unauthorized role assignments, unexpected app credentials, and suspicious Graph API activity tied to the affected application IDs.
The incident underscores the growing abuse of OAuth apps and service principals for persistence, even after credential resets. Organizations are urged to disable (not delete) the compromised service principals, remove unauthorized directory roles, and audit all app registrations for rogue credentials added since October 13, 2026. The full scope of the attack remains under investigation.
Source: https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/
ConnectWise cybersecurity rating report: https://www.rankiteo.com/company/connectwise
Microsoft Threat Intelligence cybersecurity rating report: https://www.rankiteo.com/company/microsoft-threat-intelligence
"id": "CONMIC1792239837",
"linkid": "connectwise, microsoft-threat-intelligence",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '173 Microsoft 365 partner and '
'customer tenants',
'industry': 'IT Services, Cloud Backup',
'name': 'ConnectWise',
'type': 'Vendor/Service Provider'},
{'industry': 'Various',
'name': 'Microsoft 365 Tenants (173)',
'type': 'Customers/Partners'}],
'attack_vector': 'Compromised API secret, OAuth app abuse',
'customer_advisories': 'Customers of ConnectWise Cloud Backup urged to audit '
'their Microsoft 365 tenants for unauthorized access '
'or role assignments.',
'data_breach': {'data_exfiltration': 'Under investigation (no evidence of '
'backup data access confirmed)',
'personally_identifiable_information': 'Potential (scope '
'under investigation)',
'sensitivity_of_data': 'High (potential PII, '
'business-critical data)',
'type_of_data_compromised': 'Microsoft 365 tenant data '
'(potential PII, business data)'},
'date_detected': '2026-10-15T06:13:00Z',
'date_publicly_disclosed': '2026-10-15',
'description': 'On October 15, 2026, threat actors exploited a stolen '
'ConnectWise Cloud Backup credential to gain unauthorized '
'access to 173 Microsoft 365 partner and customer tenants, '
'leveraging a trusted multitenant backup application with '
'broad permissions. The attack highlights the risks of '
'compromised vendor secrets in supply chain breaches.',
'impact': {'brand_reputation_impact': 'High (trusted vendor compromise, '
'supply chain risk exposure)',
'data_compromised': 'Potential access to Microsoft 365 tenant data '
'(scope under investigation)',
'identity_theft_risk': 'High (potential PII exposure via Microsoft '
'365 data)',
'operational_impact': 'Unauthorized access to tenant environments, '
'privilege escalation via Global '
'Administrator role assignment',
'systems_affected': '173 Microsoft 365 partner and customer '
'tenants'},
'initial_access_broker': {'backdoors_established': 'Persistent client secrets '
'added to trusted '
'applications (expiring in '
'2028)',
'entry_point': 'Stolen ConnectWise Cloud Backup API '
'secret',
'high_value_targets': 'Microsoft 365 tenants with '
'Global Administrator role '
'assignment'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Growing abuse of OAuth apps and service principals for '
'persistence; risks of excessive app permissions in supply '
'chain attacks; importance of auditing app registrations '
'for rogue credentials.',
'post_incident_analysis': {'corrective_actions': ['Rotate all vendor secrets '
'and API keys',
'Implement least-privilege '
'access for OAuth apps',
'Enhance monitoring for '
'suspicious app activity '
'and role assignments',
'Conduct regular audits of '
'app registrations and '
'service principals'],
'root_causes': ['Compromised vendor credential '
'(ConnectWise Cloud Backup API '
'secret)',
'Excessive permissions granted to '
'OAuth apps',
'Lack of monitoring for '
'unauthorized role assignments and '
'app credential additions']},
'recommendations': ['Disable (do not delete) compromised service principals',
'Remove unauthorized directory roles (e.g., Global '
'Administrator)',
'Audit all app registrations for rogue credentials added '
'since October 13, 2026',
'Review Microsoft Entra audit logs for unauthorized role '
'assignments and suspicious Graph API activity',
'Enforce least-privilege access for OAuth apps and '
'service principals'],
'references': [{'date_accessed': '2026-10-15',
'source': 'Microsoft Threat Intelligence'},
{'date_accessed': '2026-10-15', 'source': 'Huntress'},
{'date_accessed': '2026-10-15', 'source': 'ConnectWise'}],
'response': {'communication_strategy': 'Public disclosure by Microsoft and '
'Huntress, advisories to defenders',
'containment_measures': 'Disabling compromised service '
'principals, removing unauthorized '
'directory roles',
'enhanced_monitoring': 'Review of Microsoft Entra audit logs for '
'suspicious activity',
'incident_response_plan_activated': 'Yes (ConnectWise confirmed '
'containment measures)',
'remediation_measures': 'Audit of app registrations for rogue '
'credentials, removal of unauthorized '
'app secrets',
'third_party_assistance': 'Microsoft Threat Intelligence, '
'Huntress'},
'stakeholder_advisories': 'Defenders advised to review Microsoft Entra audit '
'logs for unauthorized activity tied to affected '
'AppIDs (506e08f9-6e9a-4da4-942b-a099a03644ae, '
'24205314-2b89-4e07-a2a4-579e898a5640).',
'title': 'Supply Chain Attack on ConnectWise Cloud Backup Compromises 173 '
'Microsoft 365 Tenants',
'type': 'Supply Chain Attack',
'vulnerability_exploited': 'Stolen ConnectWise Cloud Backup credential, '
'excessive OAuth app permissions'}