Full Report
ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.
Analysis Summary
# Incident Report: ConnectWise Cloud Backup Supply Chain Compromise Affecting Microsoft 365 Tenants
## Executive Summary
Attackers compromised a credential belonging to ConnectWise Cloud Backup and used it, along with permissions customers had previously granted the application, to access customers' Microsoft 365 environments. By October 15, attackers were assigning directory and administrative roles in some tenants, and unauthorized sign-ins were recorded across 162 tenants. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, revoked certificates for affected application connections, and reported no successful threat activity since. The article does not say how many customers were ultimately affected, and ConnectWise has not provided a restoration timeline.
## Incident Details
- **Discovery Date:** ConnectWise first said it was investigating "attempts of unauthorized access" on Friday (likely October 16, 2026, inferred from the article's weekday references). It confirmed unauthorized access on Saturday (likely October 17). Huntress responders had seen password spray activity earlier, on October 13–14.
- **Incident Date:** Password spray attacks began October 13–14. Broader attacks were observed starting October 15.
- **Affected Organization:** ConnectWise (IT management software vendor) and its customers using ConnectWise Cloud Backup with Microsoft 365. Four law firms were initially targeted with password spray. Tenant-level victims were not named.
- **Sector:** IT management / managed service providers (vendor). Victims include law firms and organizations in the policy, national security, trade, and critical mineral sectors.
- **Geography:** Not disclosed.
## Timeline of Events
### Initial Access
- **Date/Time:** Password spray activity from approximately October 13–14, 2026. Broader compromise activity from approximately October 15, 2026.
- **Vector:** A compromised ConnectWise Cloud Backup credential was used to access customer Microsoft 365 environments (per Huntress). Password spraying was used against initial targets (four law firms).
- **Details:** Microsoft stated that threat actors "likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All." The vendor application's existing broad access was the key enabler.
### Lateral Movement
- Attackers used the application's access to move beyond data access. In about 50 Huntress-monitored systems, attackers used ConnectWise Cloud Management apps to assign themselves directory or administrative roles.
- Huntress noted that a directory-role-capable application could escalate to Global Administrator and then add credentials to other applications, create new applications, reset user passwords and authentication methods, and change Conditional Access policies.
- Huntress warned that MSP environments could allow attackers to pivot from one customer's foothold into other customers' environments.
### Data Exfiltration/Impact
- Unauthorized sign-ins were recorded in 162 tenants.
- ConnectWise stated there is "no indication" that backup data was compromised. The article does not confirm whether mail, files, Teams, or directory data was accessed or exfiltrated.
- Service impact: Cloud Backup, SaaS Security, and Cloud Management platforms were suspended with no restoration timeline.
- A second, largely unsuccessful wave targeted policy, national security, trade, and critical mineral organizations. Most of these tenants did not use ConnectWise products, so attempts failed where the application was absent.
### Detection & Response
- **Detection:** Huntress incident responders identified password spray and later unauthorized role assignments. Microsoft and other firms (including Todyl and SpecterOps) also observed broad attacks beginning October 15.
- **Response actions:**
- ConnectWise investigated, then confirmed unauthorized access on Saturday.
- Shut down Cloud Backup, SaaS Security, and Cloud Management services.
- Remediated identified compromised credentials and identities.
- Revoked certificates used for affected application connections across all users, invalidating shared credentials used for Cloud Backup.
- Continued authentication monitoring, permission review, and forensic analysis.
- Reported no successful threat activity since these actions.
- Microsoft issued public guidance on the abused permissions.
## Attack Methodology
- **Initial Access:** Use of a compromised vendor (ConnectWise Cloud Backup) application credential. Password spraying against law firms.
- **Persistence:** Not fully disclosed. Huntress described potential persistence through added credentials on other applications, new applications with granted permissions, and altered authentication methods. Rotating the vendor credential alone was described as insufficient.
- **Privilege Escalation:** Application with Directory.ReadWrite.All permissions used to assign directory and administrative roles, in some cases potentially reaching Global Administrator.
- **Defense Evasion:** Attacks used the legitimate vendor application and existing customer-granted permissions, which may generate little evidence. Huntress noted that activity could leave no trail in some environments.
- **Credential Access:** Password spraying (law firms); compromised ConnectWise Cloud Backup credentials.
- **Discovery:** Not detailed in the article.
- **Lateral Movement:** Use of the integrated application to reach other directory resources and potentially other customer tenants in MSP scenarios.
- **Collection:** Not confirmed. ConnectWise says backup data was not compromised.
- **Exfiltration:** Not confirmed in the article.
- **Impact:** Unauthorized role assignments and sign-ins in 162 tenants; vendor service suspension.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Not confirmed. Unauthorized access to Microsoft 365 tenants could expose mailboxes, OneDrive, SharePoint, Teams, and directory data, as the application has broad access to these. ConnectWise says backup data was not compromised. Number of affected customers is unknown.
- **Operational:** Cloud Backup, SaaS Security, and Cloud Management services suspended with no restoration timeline. Customers may be unable to restore backups or manage services.
- **Reputational:** ConnectWise has had prior security incidents, including a nation-state attack on its remote management and monitoring (RMM) product the previous year. This incident adds to concerns about supply chain trust.
## Indicators of Compromise
- **Network Indicators:** None included in the article. Vendor advisories and Huntress/Todyl blog posts are referenced and should be checked for updated IOCs.
- **File Indicators:** None disclosed.
- **Behavioral Indicators:**
- Password spray attempts against law firm tenants (October 13–14).
- Unexpected assignment of directory or administrative roles to applications or users, particularly via ConnectWise Cloud Management apps (from October 15).
- Unauthorized sign-ins to Microsoft 365 tenants, particularly using the ConnectWise Cloud Backup service principal.
- Creation of new applications, added credentials on existing applications, password or authentication method resets, and Conditional Access policy changes.
- Use of Directory.ReadWrite.All permissions by the ConnectWise application outside normal patterns.
## Response Actions
- **Containment:**
- Suspended affected ConnectWise services.
- Revoked application certificates across all users, removing ConnectWise's access through those connections.
- Invalidated shared Cloud Backup credentials.
- **Eradication:**
- Remediated identified compromised credentials and identities.
- Ongoing permission review and forensic analysis.
- **Recovery:**
- No restoration timeline provided.
- Ongoing authentication monitoring.
- Customers should be checked for unauthorized role assignments and persistence mechanisms, as rotating the vendor credential does not remove attacker-created access.
## Lessons Learned
- **Key Takeaways:**
- Third-party backup and management applications with broad directory and data permissions create high-value supply chain targets.
- Revoking or rotating vendor credentials is necessary but not sufficient. Attackers may have created their own roles, applications, credentials, or policy changes.
- Vendors lacking visibility into customer tenants cannot independently determine whether a specific customer was breached.
- MSP architectures can allow lateral movement across customers.
- **What Could Have Been Done Better:**
- Apply least-privilege permissions to third-party applications, especially Directory.ReadWrite.All.
- Monitor for unusual application role assignments and service principal activity.
- Enforce strong authentication and conditional access for service accounts and applications.
- Provide customers with clearer, earlier guidance on how to check their own tenants.
## Recommendations
- **Review and reduce app permissions:** Audit all third-party applications in Microsoft Entra ID (Azure AD) and remove unnecessary high-privilege permissions such as Directory.ReadWrite.All.
- **Rotate and reissue credentials:** Rotate all credentials and certificates associated with ConnectWise Cloud Backup or related apps. Verify that old credentials no longer work.
- **Hunt for persistence:** Check for unexpected directory role assignments (especially Global Administrator), new or modified applications and service principals, added credentials on applications, password and authentication method resets, and changes to Conditional Access policies.
- **Review sign-in logs:** Investigate sign-ins by the affected service principal and any unusual sign-ins since October 13, 2026.
- **Enforce MFA and conditional access:** Require strong authentication for administrative accounts and restrict application access by location, IP, and risk level where possible.
- **Monitor audit logs:** Alert on role assignments, consent grants, new application creation, and credential additions.
- **Vendor risk management:** Assess third-party integrations with privileged access to Microsoft 365 and maintain an inventory of connected applications.
- **Password spray defenses:** Use account lockout policies, banned-password lists, and detection of distributed low-and-slow authentication attempts.
- **Incident readiness for MSPs:** Segment customer tenants where possible and ensure a compromise in one customer does not provide a path to others.