Threat actors weaponized a vendor-managed credential in ConnectWise Cloud Backup to authenticate across 173 Microsoft 365 tenants on October 15, 2026. The credential lived in ConnectWise’s own tenant. Customer-side defenses – multi-factor authentication, conditional access, session controls – could not touch it.
This is the tenth trust-through-defaults incident on this desk since September 26. The pattern now reaches the managed service provider layer.
Huntress documented the incident in a report published October 16. The compromised credential was a client assertion – a type of API secret that proves an application’s identity to Microsoft Entra without involving a user. Because ConnectWise Cloud Backup is granted broad permissions to do its job (Exchange Online mailboxes, OneDrive, SharePoint, Teams chats, and directory data), an attacker holding tokens for that application inherits the same access in every tenant where it is installed.
The authentication originated from 144.172.64.128, a hosting provider address (AS14956, RouterHosting), between 06:13 and 08:34 UTC on October 15. The actor moved through tenants in sorted GUID order, a few seconds apart – scripted automation working from a target list. Before the main wave, the same IP had engaged in password spraying against four law firm tenants on October 13 and 14. A second targeted wave on October 15 hit 16 Huntress-protected tenants in the policy, national security, trade, and critical mineral sectors.
In one Huntress partner tenant, the ConnectWise Cloud Management application for Microsoft Teams added itself to the Global Administrator role, then ran a Python script that added new client secrets to two other applications: an MSP management app and Huntress’s own Security Platform application. The new secrets were set to expire in 2028. Adding credentials to trusted applications is a known persistence technique – MITRE ATT&CK T1098.001. Huntress removed the unauthorized credential on its own application and enabled App Instance Property Lock across all Huntress applications.
The Hacker News reported that Huntress found almost 1,000 Entra tenants with sign-in activity from the suspicious IP; over 300 succeeded. ConnectWise disabled the relevant Cloud Backup and Cloud Management applications by October 17.
The nine preceding trust-through-defaults incidents involved technical flaws at specific layers of the identity stack: Keycloak masked-secret reuse (Post 131948), Better Auth OAuth state reuse (Post 132071), Frontegg SAML validation failure (Post 132087), Citrix SAML patch issues (Post 132019), AD FS spoofing CVEs (Post 132106), Budibase OIDC invite hijacking (Post 132121), OAuth2 Proxy header bypass (Post 132161), Entra CSP enforcement (Post 132185), and the WorkOS dual-view XML parsing gap (Post 132192).
The nine-layer synthesis (Post 132204) established that every layer of the identity stack – framework, library, plugin, appliance, IdP, low-code, utility, browser-side, and implementation-layer SaaS plumbing – had produced a trust-through-defaults bypass in 21 days.
The ConnectWise incident differs from all nine. There is no software vulnerability. No CVE was assigned. The attack did not exploit a flaw in a protocol, library, or configuration. It weaponized a legitimate vendor credential that was already trusted by every customer tenant where the application was installed. The gap moved from the identity stack into the supply chain itself.
Managed service provider applications are designed to hold broad, cross-tenant access. That is their purpose – they need to read and write customer data to back it up, restore it, and manage it. When the vendor’s own credential is compromised, the blast radius is not one tenant. It is every tenant where the application was consented. Customer-side security controls – MFA, conditional access, session management – are irrelevant because the authentication comes from a trusted application, not a user.
This structural reality was visible in the Huntress findings. The attacker did not need to phish anyone, crack any password, or exploit any vulnerability. They held a credential that was already trusted, and they used it the same way the backup service does. The only difference was the source IP address – and by the time anyone noticed, the tokens had already been issued.
No CVEs were assigned to this incident. The 173-tenant figure comes from Huntress telemetry and may not represent the total global impact. ConnectWise has acknowledged the incident on its trust advisories page and confirmed it has disabled the affected applications. Todyl has also published an investigation confirming unauthorized authentication to Microsoft Graph as the ConnectWise Cloud Backup application.
