ConnectWise: How to Detect & Remediate M365 Tenant Hijacking

Executive Summary

On October 17, 2026, IT management and managed service provider (MSP) software giant ConnectWise took emergency remediation action, revoking application certificates, disabling seven core Microsoft Entra ID application identities, and suspending its Cloud Backup service (formerly SkyKick). The containment measures followed the discovery that unknown threat actors obtained unauthorized access to shared application credentials and weaponized them to execute automated and manual authentication sweeps against downstream Microsoft 365 customer tenants.

Security telemetry published by Huntress reveals that adversaries probed nearly 1,000 Entra ID enterprise tenants from a dedicated external infrastructure address (`144.172.64.128`), successfully establishing authenticated sessions in approximately 300 tenants. Exploiting the inherent architecture of multi-tenant cloud application permissions, the threat actors bypassed all multi-factor authentication (MFA) and user password barriers. Once authenticated, adversaries attempted to entrench persistent access by planting rogue client secrets on existing trusted applications, registering unauthorized service principals, and elevating identities into the Global Administrator directory role.

A targeted second wave singled out 16 high-value customer environments operating across national security, government policy, foreign trade, and critical minerals sectors. Because ConnectWise's certificate revocation neutralizes only subsequent authentications through the original service connection without reversing backdoors or invalidating unexpired tokens inside individual enterprise tenants, security operations center (SOC) teams and MSP administrators must execute immediate forensic containment.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The root cause of this widespread enterprise intrusion stems from the compromise of multi-tenant OAuth 2.0 application credentials utilized by ConnectWise Cloud Backup and Cloud Management to orchestrate cross-tenant administration, automated backup synchronization, and data restoration workflows.

[ Adversary Infrastructure ] (144.172.64.128)
           │
           │ 1. Stolen Multi-Tenant App Credentials (Client Secret / Cert)
           ▼
[ Microsoft Entra ID Token Endpoint ] (login.microsoftonline.com)
           │
           │ 2. OAuth 2.0 Client Credentials Grant (App-Only Token)
           ▼
[ Enterprise Customer Tenant (Service Principal) ]
           ├── Cross-Tenant Application Permissions:
           │     ├── Exchange.ManageAsApp / Mail.ReadWrite
           │     ├── Files.ReadWrite.All / SharePoint Online
           │     ├── Directory.ReadWrite.All / Microsoft Graph
           │     └── Teams.ReadWrite.All
           ▼
[ Lateral Persistence & Privilege Escalation ]
           ├── Add Rogue Client Secrets (AuditLogs: "Add service principal credentials")
           ├── Create Backdoor Service Principals (App Registrations)
           └── Elevate Identity to Global Administrator Role

1. The OAuth 2.0 Client Credentials Grant Vulnerability

Modern SaaS backup architectures rely heavily on the OAuth 2.0 Client Credentials Grant (grant_type=client_credentials). In this authentication flow, the application authenticates directly against the Microsoft identity platform (login.microsoftonline.com/<Tenant-ID>/oauth2/v2.0/token) using its own application identity (client_id) and a cryptographic credential (client_secret or private key certificate).

Because the application acts on its own behalf (app-only permissions) rather than on behalf of an interactive user (delegated permissions):

• User MFA is completely bypassed: The authentication flow contains no human interactive challenge. Standard Conditional Access policies evaluating user risk, password policies, or MFA requirements are completely inert unless dedicated Conditional Access for Workload Identities has been explicitly licensed and enforced.
• Broad Tenant-Wide Scope: Backup solutions demand extensive read/write scopes across Microsoft 365 workloads. The compromised ConnectWise identities held high-impact Microsoft Graph and Exchange Web Services/REST permissions, including full_access_as_app, Mail.ReadWrite, Files.ReadWrite.All, and Directory.ReadWrite.All.

2. Cross-Tenant Service Principal Architecture & Dormant Risks

When an enterprise customer provisions a multi-tenant SaaS application, Entra ID instantiates a local Service Principal in the customer's tenant, referencing the vendor's multi-tenant application registration. The local service principal inherits the admin-consented permission grants.

Critically, Huntress telemetry noted that even in enterprise tenants where Cloud Backup connections were dormant or historically decommissioned without formally deleting the enterprise application object, the presence of the residual service principal permitted the threat actor to authenticate instantly once they possessed the vendor-side application credential.

3. Backdoor Implantation & Token Lifetimes

Once authenticated as the application, threat actors conducted rapid reconnaissance and initiated persistence mechanisms:

• Rogue Client Secrets: Threat actors called the Microsoft Graph API (POST /servicePrincipals/{id}/addPassword) to append unauthorized client secrets to native first-party and third-party enterprise applications.
• Rogue Service Principals: Adversaries created net-new application registrations, consented to high-privilege scopes, and generated independent API keys.
• Role Elevation: In multiple environments, adversaries attempted to assign the service principal or newly forged identities to privileged directory roles, including Global Administrator and Privileged Role Administrator.
• Token Persistence: Entra ID access tokens possess a default lifetime of 60 to 90 minutes. ConnectWise's revocation of application certificates halts new token issuance through their upstream infrastructure; however, existing issued access tokens remain fully valid within tenant memory until natural expiration unless explicitly revoked via Continuous Access Evaluation (CAE) or manual tenant-level invalidation.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

The campaign exhibits disciplined, two-phase operational tradecraft indicative of a sophisticated advanced persistent threat (APT) or highly organized cyber espionage syndicate.

Oct 13 - Oct 14, 2026: Initial Credential Compromise & Reconnaissance
├── Threat actor acquires valid multi-tenant credentials for 7 ConnectWise Entra ID applications
└── ConnectWise security diligence identifies anomalous credential activity on Oct 14

Oct 15, 2026 (08:45 - 12:35 UTC): Phase 1 - Mass Tenant Scanning Sweep
├── Ingress IP: 144.172.64.128
├── Automated probing of ~1,000 customer Microsoft 365 / Entra ID tenants
└── Successful authenticated sessions achieved across 300+ enterprise environments

Oct 15, 2026 (13:54 - 14:20 UTC): Phase 2 - Precision Targeted Espionage
├── Highly focused manual reconnaissance against 16 strategic enterprise tenants
├── Targets: National security, government policy institutes, trade diplomacy, critical minerals
└── Target APIs: MS Graph, Exchange Online, SharePoint Online, Teams, ARM, O365 Management

Oct 17, 2026 (07:00 UTC): Upstream Containment & Disruption
├── ConnectWise disables 7 application identities and revokes shared certificates
└── Cloud Backup, SaaS Security, and Cloud Management temporarily taken offline

The selective, manual second wave against strategic industries—specifically defense diplomacy, national policy think tanks, and critical supply chain mineral mining—strongly suggests a nation-state intelligence requirement rather than financial extortion or opportunistic ransomware deployment. Huntress observed no immediate ransomware deployment or extortion notes, aligning with intelligence gathering and persistent cloud access pre-positioning.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

SOC teams and Microsoft 365 tenant administrators must execute the following immediate containment runbook across every managed tenant:

Step 1: Identify and Disable Affected ConnectWise Enterprise Applications

Run the following PowerShell script using the Microsoft.Graph module to inspect the presence of the seven disabled ConnectWise application IDs and immediately revoke their sign-in capabilities:

# Connect to Microsoft Graph with Directory Auditing permissions
Connect-MgGraph -Scopes "Application.ReadWrite.All", "AppRoleAssignment.ReadWrite.All", "AuditLog.Read.All"

$compromisedAppIds = @(
    "506e08f9-6e9a-4da4-942b-a099a03644ae", # ConnectWise Cloud Backup (SkyKick)
    "2399d300-6fca-4e6a-a686-399fefe75b83", # ConnectWise Cloud Management
    "24205314-2b89-4e07-a2a4-579e898a5640", # ConnectWise Cloud Management - MS Teams
    "b78f6a77-d4e5-46fb-87e5-d1648bd02519", # ConnectWise Cloud Management - Exchange Online
    "0de14c77-b9b0-4137-9360-34878a929827", # ConnectWise Cloud Management - MS Graph
    "412dcf96-176d-4b3a-a1b0-4981ad66971e", # ConnectWise Cloud Management - Partner Center
    "b2b55f5b-7758-4719-8d8f-88ae172e6bdb"  # ConnectWise Cloud Management - SharePoint Online
)

foreach ($appId in $compromisedAppIds) {
    $sp = Get-MgServicePrincipal -Filter "appId eq '$appId'" -ErrorAction SilentlyContinue
    if ($sp) {
        Write-Warning "Found active Service Principal: $($sp.DisplayName) ($appId)"
        # Disable the service principal to block all incoming authentication attempts
        Update-MgServicePrincipal -ServicePrincipalId $sp.Id -AccountEnabled $false
        Write-Host "Disabled Service Principal: $($sp.DisplayName)" -ForegroundColor Cyan
    } else {
        Write-Host "App ID $appId not present in tenant." -ForegroundColor Gray
    }
}

Step 2: Audit and Purge Unauthorized Credentials Added Since October 13

Check for rogue client secrets or public certificates added to any enterprise application:

$auditDate = (Get-Date "2026-10-13").ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
$credentialEvents = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $auditDate and (activityDisplayName eq 'Add service principal credentials' or activityDisplayName eq 'Add application credentials')" -All

foreach ($event in $credentialEvents) {
    [PSCustomObject]@{
        Timestamp     = $event.ActivityDateTime
        Activity      = $event.ActivityDisplayName
        Initiator     = $event.InitiatedBy.App.DisplayName ?? $event.InitiatedBy.User.UserPrincipalName
        IPAddress     = $event.InitiatedBy.App.ServicePrincipalId ?? $event.InitiatedBy.User.IpAddress
        TargetApp     = $event.TargetResources[0].DisplayName
        TargetAppId   = $event.TargetResources[0].Id
    } | Format-Table -AutoSize
}

Step 3: Audit Directory Role Assignments

Verify whether any service principal or user identity was granted privileged directory roles (such as Global Administrator):

$roleAssignments = Get-MgAuditLogDirectoryAudit -Filter "activityDateTime ge $auditDate and activityDisplayName eq 'Add member to role'" -All
foreach ($ra in $roleAssignments) {
    [PSCustomObject]@{
        Timestamp   = $ra.ActivityDateTime
        RoleAdded   = $ra.TargetResources[0].DisplayName
        MemberAdded = $ra.TargetResources[0].ModifiedProperties | Where-Object { $_.DisplayName -eq 'Role.DisplayName' } | Select-Object -ExpandProperty NewValue
        Initiator   = $ra.InitiatedBy.User.UserPrincipalName ?? $ra.InitiatedBy.App.DisplayName
    } | Format-Table -AutoSize
}

Step 4: Audit Mailbox Forwarding Rules & Delegated Access

Threat actors utilizing Exchange Web Services or Graph API frequently plant hidden inbox forwarding rules to maintain stealthy email access:

# Exchange Online PowerShell Module
Connect-ExchangeOnline

# Inspect tenant-wide inbox forwarding rules
Get-Mailbox -ResultSize Unlimited | Get-InboxRule | Where-Object { $_.ForwardTo -ne $null -or $_.ForwardAsAttachmentTo -ne $null -or $_.RedirectTo -ne $null } | Select-Object MailboxOwnerId, Name, ForwardTo, RedirectTo

---

2. Network & Perimeter Defenses

1. Workload Identity Conditional Access: Implement Microsoft Entra Workload Identity Premium licensing. Configure location-based Conditional Access policies for Service Principals to restrict authentication exclusively to known, verified partner IP ranges or trusted egress CIDRs.
2. Entra Application Management Policies: Deploy directory-wide policies capping client secret validity periods to a maximum of 90 days and forbidding the creation of client secrets on multi-tenant applications by non-administrators.
3. Restrict Non-Admin App Registrations: In Microsoft Entra ID admin center, navigate to Users > User settings and set Users can register applications to No. Enforce admin consent workflows for any third-party SaaS authorization.
4. Perimeter Firewall IP Blocks: Block IP address `144.172.64.128` at perimeter egress firewalls and cloud secure web gateways (SWGs) to detect any local agents communicating with adversary infrastructure.

---

3. Endpoint Detection & Hunting Query

Validated Sigma Rule (YAML)

The following Sigma rule detects unauthorized additions of client credentials to service principals in Microsoft Entra ID, indicative of backdoor persistence:

title: Unauthorized Entra ID Service Principal Credential Modification
id: c84920b7-9512-4e0a-9d04-5f5647a508b9
status: test
description: Detects the addition of a password credential (client secret) or key credential (certificate) to an Entra ID application or service principal, a primary persistence tactic observed in cloud tenant hijacking campaigns.
references:
    - https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html?ref=cybernewsai.com
    - https://attack.mitre.org/techniques/T1098/001/
author: CyberNewsAI Threat Research Team
date: 2026/10/18
logsource:
    service: azure.auditlogs
    product: azure
detection:
    selection_operation:
        OperationName:
            - 'Add service principal credentials'
            - 'Add application credentials'
            - 'Update application - Certificates and secrets management'
    selection_result:
        Result: 'success'
    condition: selection_operation and selection_result
falsepositives:
    - Legitimate credential rotation orchestrated by approved DevOps CI/CD pipelines or enterprise cloud administrators.
level: high
tags:
    - attack.persistence
    - attack.t1098.001

Microsoft Sentinel / Defender KQL Hunting Query

Run this KQL hunting query in Microsoft Sentinel or Defender XDR to identify all service principal sign-ins from the threat actor IP 144.172.64.128 and correlate with credential modification audit events:

// Query 1: Hunt for Service Principal Sign-Ins from Adversary C2 IP
let maliciousIP = "144.172.64.128";
let compromisedAppIDs = dynamic([
    "506e08f9-6e9a-4da4-942b-a099a03644ae",
    "2399d300-6fca-4e6a-a686-399fefe75b83",
    "24205314-2b89-4e07-a2a4-579e898a5640",
    "b78f6a77-d4e5-46fb-87e5-d1648bd02519",
    "0de14c77-b9b0-4137-9360-34878a929827",
    "412dcf96-176d-4b3a-a1b0-4981ad66971e",
    "b2b55f5b-7758-4719-8d8f-88ae172e6bdb"
]);
AADServicePrincipalSignInLogs
| where TimeGenerated >= datetime(2026-10-13 00:00:00Z)
| where IPAddress == maliciousIP or AppId in (compromisedAppIDs)
| project
    TimeGenerated,
    IPAddress,
    AppId,
    ServicePrincipalName,
    ServicePrincipalId,
    ResourceDisplayName,
    ResultType,
    ResultDescription,
    LocationDetails
| order by TimeGenerated desc

// Query 2: Correlate Sign-ins with Credential Additions in Entra AuditLogs
AuditLogs
| where TimeGenerated >= datetime(2026-10-13 00:00:00Z)
| where OperationName in ("Add service principal credentials", "Add application credentials", "Add member to role")
| extend InitiatingApp = tostring(InitiatedBy.app.displayName),
         InitiatingIP = tostring(InitiatedBy.app.servicePrincipalId),
         TargetApp = tostring(TargetResources[0].displayName)
| project
    TimeGenerated,
    OperationName,
    InitiatingApp,
    InitiatingIP,
    TargetApp,
    Result,
    AdditionalDetails
| order by TimeGenerated desc

Splunk (SPL) Hunting Query

Search for all authentication activity originating from the threat actor IP and identify rogue credential generation:

index=azure sourcetype="azure:aad:audit" (operationName="Add service principal credentials" OR operationName="Add application credentials" OR operationName="Add member to role") earliest="10/13/2026:00:00:00"
| spath path=targetResources{}.displayName output=TargetApplication
| spath path=initiatedBy.app.displayName output=InitiatingApp
| table _time operationName InitiatingApp TargetApplication result
| sort - _time

---

(Note: Authoritative advisories indicate compromise of application identities rather than host-based binary malware; hunt using Entra ID service principal telemetry and network ingress indicators listed above.)