ConnectWise Suspends Cloud Services After Microsoft 365 Compromise

ConnectWise disabled seven application identities and suspended its Cloud Backup service after threat actors compromised Microsoft 365 tenants using stolen credentials. The attack exploited application-level permissions to access customer environments without requiring individual user passwords, enabling unauthorized access to mailboxes, SharePoint, Teams, and directory data. ConnectWise revoked certificates and disabled affected services, but existing backups remain encrypted and isolated. Huntress identified targeted malicious activity from an IP address, with 300 successful sign-ins across nearly 1,000 tenants, though some were blocked by missing service principals. The company is investigating the breach’s origin, while partners are urged to audit tenant activity, disable compromised applications, and review authentication policies. Attackers may have used stolen credentials to add apps to the Global Administrator role, creating persistent access vectors.