<![CDATA[ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants]]>ConnectWise has disabled seven application identities as it investigates an incident where unknown threat actors gained unauthorized access to those identities and compromised Microsoft 365 tenants. The company disclosed the update on Saturday, confirming the investigation is ongoing.

The disabled application identities include:

  • ConnectWise Cloud Backup — 506e08f9-6e9a-4da4-942b-a099a03644ae
  • Additional ConnectWise application identities, based on the list published by the company

The company has not publicly detailed how the identities were obtained or the full scope of the affected tenants. The suspension of Cloud Backup appears to be a containment measure while the investigation proceeds.

Organizations using ConnectWise products — particularly those integrated with Microsoft 365 — should review their tenant configurations and monitor for any unauthorized application access or activity tied to the listed identity.

Source: The Hacker News

Are any members running ConnectWise Cloud Backup in their environments, and have you taken steps to audit your M365 application identities since this disclosure?

]]>https://xploitlk.com/topic/729/connectwise-suspends-cloud-backup-after-attackers-compromise-microsoft-365-tenantsRSS for NodeTue, 27 Oct 2026 07:51:32 GMTSun, 18 Oct 2026 10:30:17 GMT60