ConnectWise Cloud Management - MS Teams (<= 2026-10-16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/connectwise-cloud-management---ms-teams--2026-10-16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 17 Oct 2026 10:28:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthorized Access via Compromised ConnectWise M365 Vendor Credentialshttps://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-abuse/Sat, 17 Oct 2026 10:28:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-connectwise-m365-abuse/Threat actors are leveraging compromised API secrets from ConnectWise Cloud Backup and MS Teams integration applications to gain unauthorized administrative access and establish persistence in Microsoft 365 environments.Threat actors have obtained API secret credentials for ConnectWise Cloud Backup (formerly SkyKick) and ConnectWise Cloud Management - MS Teams applications. These credentials allow attackers to impersonate these legitimate service provider applications to authenticate into customer Microsoft 365 tenants. Because these applications are granted broad permissions to interact with Exchange, OneDrive, SharePoint, and Entra ID data, the compromise provides attackers with extensive read/write access. Observed activity beginning October 15, 2026, involves automated scripts iterating through target tenants to request Microsoft Graph tokens. Attackers have been observed using these elevated permissions to grant themselves Global Administrator roles and add malicious credentials to other applications within the target tenant, creating a persistent backdoor independent of the initial compromised integration.

Attack Chain

  1. Attackers obtain valid API client assertions for ConnectWise service applications via a breach of the vendor infrastructure.
  2. Attackers perform automated authentication to customer Microsoft 365 tenants using the compromised application identities from a hosting provider IP (144.172.64.128).
  3. Attackers acquire Microsoft Graph API tokens with the permissions historically consented to the ConnectWise applications.
  4. Attackers leverage the compromised app's directory permissions to escalate their privilege level to Global Administrator.
  5. Attackers create new credentials for existing, unrelated applications within the tenant to ensure long-term persistence.
  6. Attackers potentially exfiltrate sensitive data from mailboxes, OneDrive, and SharePoint repositories.

Impact

At least 162 M365 tenants have been confirmed compromised as of October 16, 2026. The compromise allows attackers to read and potentially exfiltrate sensitive directory, email, and document data. The establishment of persistence via new application credentials means that even if the initial ConnectWise integration is disabled, the attacker maintains unauthorized access until the newly added fraudulent credentials are removed.

Recommendation

  1. Immediately disable the affected ConnectWise applications (App IDs: 506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640) in your Microsoft 365 environment.
  2. Perform a comprehensive audit of all applications in the Entra ID portal to identify and remove any unauthorized credentials added recently.
  3. Review Microsoft Entra sign-in logs for any API-based authentication attempts originating from the identified malicious IP 144.172.64.128.
  4. Ensure all newly added credentials for high-privilege applications are thoroughly vetted and approved by internal security teams.
]]>criticaladvisorycloud-securitysupply-chainm365identity-compromise