Cloud software provider **ConnectWise** has announced ongoing remediation measures following a security incident that led to unauthorized access to application identities associated with its Cloud Backup service. The company initiated mitigations on October 17, three days after the incident was first identified. Key actions taken by **ConnectWise** include strengthening administrative-access protections, resetting accounts, and replacing application credentials. The incident also prompted the precautionary suspension of **ConnectWise** Cloud Backup, SaaS Security, and Cloud Management due to their integration. **ConnectWise** has enlisted independent third-party specialists to assist with incident response and remediation efforts. The company is actively validating the effectiveness of its containment measures and states that it has not observed successful threat activity in the environments it directly monitors. However, **ConnectWise** emphasizes that this observation does not confirm the security of individual partner or customer **Microsoft 365** tenants. Reviewing each potentially affected tenant remains crucial for partners. > "Before making changes, preserve relevant evidence, validate findings, and assess potential operational impacts. Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated. Do not reconnect affected applications until **ConnectWise** provides formal restoration instructions." Cybersecurity firm **Huntress** has shared observed IP addresses linked to the activity, noting that some password spray and failed login attempts are likely unrelated to the primary application sign-in vector. * **144.172.64[.]128**: Observed in application sign-ins using a vendor credential (identified as the primary vector). * **144.172.64[.]99**: Linked to concentrated failed user password spray attempts (October 10-14, 2026). * **144.172.64[.]60**: Associated with a few failed user logins (October 18, 2026). * **144.172.94[.]243**: Involved in a broad, ongoing failed login spray targeting numerous organizations. **Huntress** researchers stated in an update, "In a review of application sign-ins across more than 10,000 tenants with **ConnectWise** applications (where we can see those logs), **144.172.64[.]128** and **Microsoft**-internal ranges are the only addresses that produced application sign-in activity." The firm also noted observing post-compromise actions on a second tenant, mirroring the previously identified modus operandi. In these instances, the compromised application granted itself **Global Administrator** privileges and then added a new secret to a small number of other applications within the tenant for persistence. While the access may have been utilized for **Microsoft Graph** directory reads, there is currently no evidence that attackers weaponized it for mailbox or file manipulation, or to enact user or policy changes. "The choice of which applications to backdoor appeared to be random in the two tenants we reviewed," **Huntress** added. "Across the two compromised tenants, the identical grant flow selected two completely different sets of applications. The only consistent criteria we can point to is structural: credentials were planted in applications that are registered inside the affected tenant, without regard to what those applications can actually do."