Full Breakdown
ConnectWise Credential Compromise Exposes Hundreds of Microsoft 365 Tenants
By Drooid · · How we work
Core Event: Unauthorized Access via a Compromised ConnectWise Service Account
On October 13, 2026, investigators detected unauthorized access to 173 Microsoft 365 tenants after a ConnectWise service-account credential used for delegated admin privileges was compromised. The stolen credential let threat actors authenticate as the application and request access tokens from Microsoft Entra ID, potentially reaching mailboxes, SharePoint, Teams, and directory data. The attack used only legitimate Microsoft 365 administration tools; no custom malware or ConnectWise software vulnerability was found.
Timeline
- October 13, 2026 – Unauthorized sign-ins observed at 03:12 UTC.
- October 14, 2026 – ConnectWise’s monitoring identified the issue and began investigations.
- October 15 – A second wave from IP 144.172.64.128 targeted 16 tenants in policy, national-security, trade and critical-mineral sectors.
- October 16-18, 2026 – Public disclosure, disabling the compromised credential and revoking delegated admin privileges.
- October 17, 2026 – ConnectWise disabled seven application identities and suspended the Cloud Backup service by revoking certificates.
Data & Statistics
- 173 Microsoft 365 tenants affected.
- 7 ConnectWise application identities disabled.
- About 1,000 Entra tenants showed sign-in activity from the malicious IP; 300 of those sign-ins succeeded (Huntress).
- The October 15 wave attempted access to Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra and Office 365 Management APIs across 16 tenants.
Official Statements & Responses
ConnectWise said disabling the affected connections stops new authentication but does not reverse changes already made inside a tenant. Scheduled backups are halted, archives remain encrypted and isolated, and there is no evidence the archives were accessed. SaaS Security and Cloud Management services were taken offline pending review.
Huntress analysts noted that after the initial wave no further malicious activity was observed, but warned that added credentials could allow continued access even if the original secret is revoked. They highlighted several Entra controls that can limit damage from stolen application credentials.
Verbatim Quotes
- “We last observed malicious sign-ins from the original address on October 15 at 08:45 UTC, with targeted, manual activity continuing until about 14:20 UTC that day,” — Jon Semon, Principal Security Operations Analyst, Huntress
- “ConnectWise has said access to Cloud Backup is shut off, and if so, activity through that service should have stopped. However, if the threat actor was able to add credentials to applications in Microsoft tenants, those credentials would let them keep access and act as the application.” — Huntress analyst
- “Several Entra controls limit the damage if an application credential is stolen,” — Huntress analyst
Why It Matters / Impact
The incident highlights the risk of delegated admin privileges granted to managed-service providers. Compromising a single service-account credential allowed threat actors to reach a large set of downstream customers and access high-value data across sectors. The reliance on native Microsoft 365 tools for both attack and detection complicates response, underscoring the need for stricter application-management policies, credential-lifetime limits, and conditional-access controls for workload identities.