The IT Nerd

ConnectWise has disabled affected cloud applications after attackers used a compromised vendor credential to gain unauthorized access to customer Microsoft 365 environments, according to a Saturday blog post.

Huntress identified nearly 1,000 Microsoft Entra tenants with suspicious sign-in activity, including more than 300 successful sign-ins. In one customer environment, a ConnectWise application obtained Global Administrator privileges and added unauthorized credentials to other applications, including a Huntress security application.

The activity involved ConnectWise Cloud Backup, formerly SkyKick, and cloud management applications for Microsoft Teams, Exchange and SharePoint. Huntress warned that disabling affected applications does not remove credentials already added by attackers. The full extent of data access remains under investigation.

Denis Calderone, Principal / CTO, Suzu Labs:

“ConnectWise just showed why an approved Entra app has to be treated like standing privileged access. App-only identities sit outside the controls you built for people. No user, no device, no MFA prompt, and revoking user sessions does nothing. The vendor secret is a master key to every tenant that already approved the app, and a lot of what it can read through Graph never shows up in the audit log, so it’s hard to know when it’s being abused. In at least one tenant a ConnectWise application granted itself Global Administrator and planted new secrets on other apps, including Huntress’s own security application. Disabling ConnectWise does not pull those extra keys.

“They pointed the stolen publisher secret at those tenant IDs. That’s it. Cloud Backup is a multi-tenant application, so the credential lives in ConnectWise’s tenant and works against every customer where an admin already approved the app. All they did was present the secret, name a tenant, and Entra issues a Graph token if the service principal is there. If the app was never “consented,” the attempt fails. The other wrinkle is leftover approvals. Todyl saw successful sign-ins in tenants that had no active backup subscription. You can have a leftover SkyKick approval sitting in Entra from an old MSP relationship even if nobody has used the product in years. The attacker does not have to know your vendor stack; they just have to try the key and see what they get back.

“I would advise anyone with ConnectWise to hunt for the extra keys and disable the seven ConnectWise and SkyKick apps Huntress listed if found. Do not delete them though. Instead pull service principal sign-ins from October 13 on, not user sign-ins, and look for 144.172.64.0/24 addresses. I’d also suggest reviewing client secrets and certificates on every enterprise application added since October 13, starting with MSP tools and security tools. Check the Entra audit log for service principals adding themselves to directory roles. It’s probably also a good idea to hunt mailbox forwarding, inbox rules, and delegated access the same way you would after any mailbox compromise. Do not re-enable anything until ConnectWise confirms those credentials have been rotated. If you find a secret you did not create, assume they still have a way in.”

ㅤ

John Strand, Owner, Black Hills Information Security:

“I’m really, really not impressed with how ConnectWise has handled this incident so far. It doesn’t feel like they’ve been open enough about what happened. They keep emphasizing that backup data wasn’t accessed, but if you look at the Huntress report, the concern goes well beyond stored backups. What else could the attackers access? Compromised application credentials can let attackers into customer tenants and give them access to data through Microsoft Graph. Customers need a clear explanation of that exposure.

“I think whoever is handling communications at ConnectWise is dropping the ball. We see this with too many organizations. They think carefully worded statements and splitting hairs will make things better. In my experience, the companies that come out better are the ones that explain what happened, what they know, what they don’t know, and what customers can do to protect themselves.

“ConnectWise needs to understand that we’re in the middle of the SaaS apocalypse. Customers have options. They can move to another vendor, replace a service, or increasingly build something themselves. Your technology alone isn’t going to keep them around. What matters more than anything is trust.

“Trust isn’t about doing everything right. It’s about how you represent and conduct yourself when things go wrong. ConnectWise can do better. They can recover from this, but that requires changing how they communicate and act moving forward.”

If you have ConnectWise, you need to take action ASAP as the bad guys are absolutely hunting for you to get access.

ConnectWise today announced the release of its 2026 MSP Threat Report, delivering global threat intelligence and actionable guidance for Managed Service Providers (MSPs) navigating one of the most complex cybersecurity landscapes to date. The report details the most significant threats observed throughout 2025 and reflects ConnectWise’s continued evolution in helping customers secure and strengthen their businesses as identity, access and trust relationships become the primary battleground in modern cyberattacks.

Drawing from real-world incident response investigations, ConnectWise customer telemetry, ransomware leak site monitoring and malicious infrastructure tracking, the 2026 report reveals a decisive shift in attacker strategy: adversaries are no longer relying primarily on novel exploits. Instead, they are exploiting trusted identities, legitimate system tools, remote access infrastructure, and software supply chains to gain faster, more scalable access to MSP-managed environments worldwide.

Global threat landscape demands platform-level defense
The 2026 MSP Threat Report highlights trends observed across North America, Europe, and Asia-Pacific (APAC), reinforcing that while regional nuances exist, the underlying risks are consistent worldwide.

• Ransomware prioritized speed and access reliability – Rather than innovating encryption techniques, ransomware operators refined how they gained access. Groups such as Akira demonstrated rapid “scan, steal, encrypt” lifecycles, often targeting backup infrastructure early to prevent recovery. Attackers also bypassed OTP-based multi-factor authentication (MFA) by exploiting inherited VPN configuration artifacts or retained appliance secrets.

Key regional ransomware trends include:

• In North America, ransomware operators prioritized speed and early backup disruption in midsized business environments.
• European manufacturing and supply chain ecosystems saw increased targeting through credential and remote access abuse.
• Growing SMB markets in APAC experienced expanding exposure of perimeter infrastructure and credential-stuffing campaigns.
• VPN infrastructure became a consistent entry point – Publicly exposed SSL VPN interfaces were repeatedly targeted through credential stuffing, inherited secrets and critical vulnerabilities affecting major vendors. In multiple cases, organizations experienced full domain compromise within hours of successful VPN authentication.

• Software supply chain compromise expanded downstream risk – Supply chain attacks intensified in both scale and automation. Campaigns such as “Shai-Hulud” compromised npm maintainer accounts and propagated trojanized updates across thousands of downstream environments. Other ecosystems, such as PyPI, NuGet, RubyGems, and Rust, faced phishing and malicious package injection campaigns that turned routine dependency updates into execution paths.
• ClickFix and user-mediated execution matured – ClickFix-style social engineering attacks, in which users are manipulated into copying and pasting malicious commands into legitimate utilities, emerged as a repeatable and adaptable intrusion method. The tactic bypasses traditional defenses by shifting execution responsibility to the user.

• AI increased attacker scale and realism – Although AI’s direct artifacts are often invisible in forensic telemetry, its impact was evident through increases in deepfake-enabled fraud, LLM-generated phishing campaigns, AI-assisted malware development, and automation that lowered barriers to entry for threat actors globally. Rather than creating new attack categories, AI made established tactics faster, more scalable and more convincing.

ConnectWise: Evolving with the threat landscape

The 2026 MSP Threat Report underscores a critical reality: reactive security models are no longer sufficient. Defenders must move earlier in the attack lifecycle, focusing on identity, privilege, execution context, and resilience.

ConnectWise is addressing this shift by continuing to strengthen and integrate cybersecurity and data protection capabilities across the ConnectWise Platform, including:

• Privileged Access Management (PAM) to enforce least-privilege and reduce blast radius from credential compromise.
• Managed Endpoint Detection and Response (Managed EDR) to provide continuous, behavior-based monitoring and rapid containment.     
• Security Information and Event Management (SIEM) to correlate identity, endpoint and network telemetry across multi-tenant environments.
• Business Continuity and Disaster Recovery (BCDR) with immutable backup capabilities designed to resist tampering—even in ransomware scenarios.

The 2026 MSP Threat report is made possible by the ConnectWise Cyber Research Unit™ (CRU), an elite team of threat hunters and cybersecurity professionals who gather intelligence 24/7 from real-world incidents, customer environments, ransomware leak sites and malicious infrastructure monitoring. The full report is available for download at this link.