Quick Summary

ConnectWise suspended Cloud Backup after attackers compromised application identities and gained unauthorized access to Microsoft 365 tenants. Investigators observed suspicious service principal sign-ins, privilege escalation, and attempts to establish persistence through application credentials.

The incident highlights how attackers can abuse trusted cloud applications to access customer environments without signing in as individual users.

How the Attack Worked

1. Compromised application credentials: Attackers authenticated as trusted applications through Microsoft Entra ID.

2. Cloud resource access: Existing permissions potentially enabled access to Exchange Online, SharePoint, Teams, and Microsoft Graph.

3. Privilege escalation: Some application identities assigned themselves directory roles, including Exchange Administrator.

4. Persistence: In one reported tenant, an application identity granted itself Global Administrator privileges and added credentials to other applications.

5. Continued access: Disabling the original application may not remove credentials, permissions, or access established separately.

IOC & Indicators to Hunt

Reported indicators

The source also identifies affected application identities for Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. Search for their application IDs in Entra sign-in and audit logs.

Hunting window: Begin with October 13, 2026, and continue through the current date, expanding the window if earlier suspicious activity is found.

These indicators are investigation leads, not standalone proof of compromise. IP addresses and user agents can be shared or spoofed.

Threat Hunting: Microsoft Entra ID

Hunt 1 — Suspicious service principal sign-ins

Search Entra service principal sign-in logs for the listed IP addresses and application IDs. Identify successful authentications, unfamiliar source locations, unusual user agents, and activity outside the application's normal pattern.

Hunt 2 — Unexpected privilege assignments

Review Entra audit logs for service principals assigned privileged directory roles, especially Global Administrator and Exchange Administrator. Identify who or what initiated each change and whether it was approved.

Hunt 3 — Application credential changes

Search for newly added client secrets, certificates, application owners, OAuth grants, and permission changes. Prioritise changes occurring after suspicious service principal authentication.

Hunt 4 — Persistence and data access

Investigate unexpected Microsoft Graph activity, mailbox forwarding rules, delegated mailbox access, and unusual SharePoint or Teams access. Determine whether the attacker accessed data or established alternative access.

Important: Disabling a compromised application does not necessarily remove credentials planted in other applications or invalidate every existing token.

Sigma Detection Rule

The following illustrative Sigma rule hunts for successful Microsoft Entra service principal sign-ins from the reported IP addresses. It assumes the SIEM normalises Entra logs into the Sigma azure.signinlogs category and exposes the relevant fields.

title: ConnectWise Incident - Suspicious Service Principal Sign-In IP
id: 8d8f0f62-95b2-4e2c-9a17-cc2c6c3c51b1
status: experimental
description: >
  Detects service principal sign-ins from IP addresses
  reported in the ConnectWise cloud identity incident.
  Validate field mappings and enrich with application IDs.
references: []
author: CyberIncidents
date: 2026/10/19
tags:
  - attack.initial-access
  - attack.persistence
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    IPAddress:
      - '144.172.64.128'
      - '144.172.64.99'
      - '144.172.64.60'
  selection_service_principal:
    signInEventTypes|contains: servicePrincipal
  condition: selection_ip and selection_service_principal
falsepositives:
  - Legitimate service traffic routed through a reported IP
level: high

Validation notes: Field names and event-type values vary by connector and Sigma backend. Confirm the schema and successful sign-in fields in your environment before deployment. The rule detects matching sign-in activity; it does not prove malicious access or detect every stage of the attack.

Prevention & Response

• Disable affected application connections according to vendor and incident-response guidance.

• Review all managed customer tenants, including older or dormant integrations.

• Remove unauthorised credentials, permissions, and privileged role assignments.

• Investigate and revoke remaining application access or tokens where supported.

• Restrict who can create application credentials and grant privileged permissions.

• Monitor service principal sign-ins and alert on unexpected role assignments.

• Preserve audit logs and validate backup availability and restoration procedures.

Conclusion

The ConnectWise incident shows why cloud threat hunting must go beyond user accounts. Application identities can hold broad permissions and provide attackers with a route to sensitive Microsoft 365 resources.

The key hunting priority is to correlate service principal sign-ins with role assignments, application credential changes, and subsequent cloud activity across every managed tenant.