ConnectWise Suspends Cloud Backup Following Application Identity Incident

ConnectWise has suspended its Cloud Backup service after unauthorized access to application identities associated with the product, and has reset accounts and replaced application credentials as part of its response. SaaS Security and Cloud Management were also suspended as a precaution because they are integrated with Cloud Backup.

The company began rolling out mitigations at 5:00 a.m. UTC on October 17, three days after first identifying the incident. It said it had disabled affected application connections, strengthened administrative-access protections and engaged independent third-party specialists for incident response and remediation.

Services remain suspended while containment is validated

ConnectWise said it is validating the effectiveness of its containment measures and has not observed successful threat activity in the environments it monitors. It added that it has no evidence that products and services beyond Cloud Backup, SaaS Security and Cloud Management are affected.

That assessment does not establish whether individual partner or customer Microsoft 365 tenants were affected. ConnectWise advised organizations to review every potentially affected tenant, preserve relevant evidence before making changes, validate findings and consider operational consequences. It also said affected applications should not be reconnected until formal restoration instructions are issued.

Huntress identifies application sign-in activity

Huntress reported that, in application sign-in logs visible across more than 10,000 tenants running ConnectWise applications, 144.172.64[.]128 and Microsoft-internal ranges were the only addresses that generated application sign-in activity. Huntress described 144.172.64[.]128 as the address associated with application sign-ins using a vendor credential.

The researchers separately listed 144.172.64[.]99, which showed concentrated failed user password-spray attempts between October 10 and 14; 144.172.64[.]60, which recorded a small number of failed user logins on October 18; and 144.172.94[.]243, which showed broad failed login spraying against many organizations. Huntress said those password-spray and failed-login events were unlikely to be related to the application sign-in activity, despite the addresses being in the same RouterHosting provider range, AS14956.

Persistence observed in two compromised tenants

Huntress also identified post-compromise activity in a second tenant that followed the same pattern: the application granted itself the Global Administrator role and added a new secret to a small number of other tenant applications to maintain persistence.

The access may have been used for Microsoft Graph directory reads, but Huntress found no signs of mailbox or file manipulation, user changes or policy changes. The applications selected for new credentials differed across the two tenants, with the common feature being that they were registered inside the affected tenant rather than their particular capabilities.

For businesses and managed service providers, the immediate implication is to retain evidence, inspect Microsoft 365 application permissions and newly added secrets, and avoid reconnecting affected ConnectWise integrations until the company provides restoration guidance.