ConnectWise breach: cloud services disruption enters third day

ConnectWise took Cloud Backup, SaaS Security and Cloud Management offline after detecting unauthorized access on 16 October. Attackers signed into Microsoft 365 tenants via the app and obtained Microsoft Graph tokens; Huntress confirmed unauthorized sign-ins in 162 tenants and activity from one IP across nearly 1,000 Entra tenants.

• Cloud Backup was shut off at 05:00 UTC on 17 October, two more services eight hours later
• Huntress confirmed unauthorized sign-ins in 162 Microsoft 365 tenants
• Nearly 1,000 Entra tenants saw sign-ins from IP 144.172.64.128, over 300 succeeded
• Attackers granted the app Global Administrator and planted new secrets