Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: ConnectWise customers and MSPs
Incident: Unauthorized access to ConnectWise application identities used to compromise customer Microsoft 365 tenants.
Impact: Potential unauthorized access to tenant data and temporary suspension of cloud backup and management services.
Attacker: Unidentified threat actors
Analysis: Attackers gained unauthorized access to specific ConnectWise application identities, enabling them to bypass individual user passwords and enter customer M365 environments. While backup archives appear secure, the breach allowed direct tenant access, forcing ConnectWise to suspend key cloud services. This incident underscores the systemic risk of relying on third-party application permissions for cloud environment management.
Recommendations: Audit Microsoft 365 tenants for unauthorized application permissions or suspicious service principal activity.; Revoke all existing access tokens related to ConnectWise Cloud Backup and Management identities.; Review tenant logs for unusual data access or configuration changes occurring around mid-October 2026.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source