---
title: 'Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants'
url: 'https://securteksecurity.com/news/connectwise-cloud-backup-credential-173-microsoft-365-tenants'
markdown: 'https://securteksecurity.com/news/connectwise-cloud-backup-credential-173-microsoft-365-tenants.md'
date: '2026-10-17'
description: 'Huntress confirmed unauthorized service principal sign-ins in 173 ConnectWise Cloud Backup partner and customer tenants on October 15, 2026, between 06:13 and 08:34 UTC, from the address 144.172.64[.]128. The actor moved through tenants in sorted GUID order, a few seconds apart, in what Huntress de…'
taxonomy:
  category:
    - Cybersecurity
---

# [Compromised ConnectWise Cloud Backup credential used to sign in to 173 Microsoft 365 tenants](https://securteksecurity.com/news/connectwise-cloud-backup-credential-173-microsoft-365-tenants)

   17th Oct 2026  

Huntress confirmed unauthorized service principal sign-ins in 173 ConnectWise Cloud Backup partner and customer tenants on October 15, 2026, between 06:13 and 08:34 UTC, from the address 144.172.64\[.\]128. The actor moved through tenants in sorted GUID order, a few seconds apart, in what Huntress describes as a script working from a target list, minting Microsoft Graph tokens with the backup application's broad consented permissions: mailboxes, OneDrive, SharePoint, Teams, and directory data. Todyl independently detected the same Graph authentication, and Microsoft Threat Intelligence is tracking the activity as an active supply chain attack. In at least one partner tenant, a separate ConnectWise application assigned itself Global Administrator privileges and added client secrets to two other trusted applications.

ConnectWise confirmed unauthorized access to application identities in the Cloud Backup environment and has closed Cloud Backup application access until further notice. The company says it has found no evidence that partner backup data was compromised. Defenders are advised to review service principal sign-ins for the Cloud Backup application, disable the application until ConnectWise confirms all credentials have been reset, and audit for any credentials added to other applications since October 13, because tokens already issued can remain valid for up to 90 minutes after the application is disabled.

Update, October 18: Huntress now reports sign-in activity from the same address in almost 1,000 Entra tenants, with about 300 successful sign-ins; a successful sign-in does not by itself establish tenant compromise, and in some tenants the absence of a service principal prevented access. Huntress also identified a second, targeted wave of attempts on October 15 against 16 tenants in the policy, national security, trade and critical mineral sectors, which it says was unsuccessful, and confirmed abuse of the Cloud Management Teams application in one tenant. ConnectWise, in its October 18 advisory update, says it disabled all seven application identities at 07:00 UTC on October 17, revoked the affected certificates and invalidated the shared Cloud Backup credentials, and has temporarily taken SaaS Security and Cloud Management offline as a precaution. Cloud Backup remains suspended, scheduled backups are not running, and archive and restore access remains unavailable, with no restoration time given; ConnectWise says existing archives remain encrypted and isolated, with no evidence they were accessed.

Sources: [The Hacker News](http://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html); [CybersecurityNews](https://cybersecuritynews.com/connectwise-credentials-microsoft-365-accounts/); [The Hacker News](http://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html); [ConnectWise Trust Center advisory](https://www.connectwise.com/company/trust/advisories)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [Community Medical Center in Falls City shuts down network after cyberattack; critical patients diverted](https://securteksecurity.com/news/community-medical-center-falls-city-cyberattack-critical-patients-diverted.md)
- Next: [Convertr supply chain skimmer stole payment card data from Brazilian checkouts](https://securteksecurity.com/news/convertr-plausible-supply-chain-skimmer-steals-payment-card-data.md)