Cybersecurity researchers have uncovered an ongoing campaign where threat actors are exploiting a compromised Microsoft 365 credential linked to ConnectWise Cloud Backup. The attackers have used this credential to access 173 partner and customer tenants, leveraging the broad permissions granted to the backup service to read mailboxes, files, and directory data.
Huntress Labs reported that the unauthorized sign-ins originated from the IP address 144.172.64[.]128 on October 15, 2026, between 06:13 and 08:34 UTC. The attackers appeared to be using a script to systematically target tenants, moving through them in sorted GUID order. Additionally, the same IP was involved in password spraying attacks against four law firm tenants on October 13 and 14, though no successful sign-ins were detected.
In one affected tenant, Huntress observed a separate ConnectWise app assigning itself Global Administrator privileges and adding credentials to other trusted applications. This action could extend the risk beyond the vendor account, potentially compromising other privileged apps within customer environments. ConnectWise has temporarily disabled Cloud Backup application access and assured users that no partner backup data has been compromised.
Users are advised to disable the ConnectWise Cloud Backup application until the credentials are reset, enable Microsoft Graph activity logs, and audit for any new credentials added since October 13, 2026. The incident highlights the risks associated with broad access permissions granted to third-party applications.