ConnectWise Cloud Backup: a stolen app credential used to sign in to Microsoft 365 customer tenants

How it happened

The attackers used a compromised credential of the ConnectWise Cloud Backup app (a client assertion, according to Huntress) and signed in to customer Microsoft 365 tenants through that trusted app. Microsoft says they likely abused permissions previously granted by customers. ConnectWise speaks of unauthorized access to application identities in its Cloud Backup environment; how the credential was obtained is not public.[2][3][4] Checked 9 Nov 2026

What was stolen

No data theft confirmed. Huntress saw the access used for Microsoft Graph directory reads, with no sign of mailbox or file manipulation. In one tenant, a ConnectWise app added itself to the Global Administrator role and added new secrets to other apps to keep access. ConnectWise says it has no evidence that partner backup data was compromised.[2][3][4] Checked 9 Nov 2026

Who was impacted

Managed service providers and their customers using ConnectWise Cloud Backup: Huntress confirmed unauthorized sign-ins in 162 customer tenants, and the suspension of Cloud Backup, SaaS Security and Cloud Management stopped scheduled backups, restores and archive access for all users of those services.[2][3] Checked 9 Nov 2026

Threat actor

Not attributed

Timeline

1. 13 Oct 2026On October 13 and 14, the IP address later used in the attack runs password spraying against four law-firm tenants, according to Huntress. No successful sign-in is seen. [1][2]
2. 15 Oct 2026The attackers sign in with the Cloud Backup app credential and move through customer tenants. In one tenant, the ConnectWise Cloud Management app for Teams adds itself to the Global Administrator role. [1][2]
3. 17 Oct 2026ConnectWise suspends Cloud Backup and disables the affected application connections: "We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment." Huntress then counts unauthorized sign-ins in 173 tenants. [1][2][4]
4. 18 Oct 2026ConnectWise also shuts down SaaS Security and Cloud Management as a precaution. [2][4]
5. 19 Oct 2026Huntress confirms unauthorized sign-ins in 162 customer tenants. Microsoft says the attacker likely abused permissions previously granted by customers. A ConnectWise spokesperson says there is no evidence that partner backup data was compromised. No source attributes the attack. [2][3]
6. 20 Oct 2026ConnectWise says it "completed an account and credential reset" and is preparing a phased restoration. It asks customers not to reconnect affected apps until it gives formal instructions. [4]