Actor Profile

The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave. The actor demonstrated sophisticated understanding of Microsoft Entra ID (Azure AD) application identity abuse, OAuth token manipulation, and cloud service provider (CSP) trust relationships. Initial compromise vector remains under investigation by ConnectWise, with the credential-exposure mechanism not yet determined. The actor's operational security included use of specific IP infrastructure (144.172.64[.]128) and manual, targeted follow-on activity suggesting human-operated intrusion rather than automated exploitation.

TTPs (Tactics, Techniques, Procedures)

The campaign leveraged compromised ConnectWise application identities to abuse OAuth 2.0 authentication flows and Microsoft Entra ID trust relationships. Key techniques include: Initial Access via stolen application credentials (T1199 - Trusted Relationship); Valid Accounts exploitation using application identities (T1078.004 - Cloud Accounts); Privilege Escalation by adding compromised applications to Global Administrator role (T1098 - Account Manipulation); Persistence through creation of client secrets on trusted applications and provisioning of new malicious applications (T1098.001 - Additional Cloud Credentials, T1136.003 - Create Account: Cloud Account); Collection of email, SharePoint documents, Teams messages, and directory data via Microsoft Graph API and service-specific APIs (T1114.002 - Email Collection: Remote Email Collection, T1213.002 - Data from Information Repositories: SharePoint). The actor requested access tokens for Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management API, demonstrating broad cloud service enumeration and data access capabilities.

Targets & Patterns

Primary victims are ConnectWise customers in the IT services and cloud services sectors, specifically managed service providers (MSPs) and organizations using ConnectWise Cloud Backup and Cloud Management products. Seven ConnectWise application identities were compromised, affecting an unknown number of downstream Microsoft 365 tenants. A secondary, highly targeted wave on October 15, 2026, focused on 16 specific tenants in policy, national security, trade, and critical mineral sectors, indicating potential espionage objectives. The targeting pattern suggests the actor differentiated between opportunistic access (broad MSP customer base) and strategic intelligence collection (government-adjacent and critical infrastructure entities). The attack exploited the trust relationship inherent in MSP tooling, where a single compromised application credential provides scalable access to multiple customer environments without individual credential theft.

Historical Context

This incident follows a pattern of supply chain and trusted relationship compromises targeting MSP platforms and IT management software. Similar attacks include the Kaseya VSA ransomware supply chain attack (July 2021), SolarWinds Orion compromise (2020), and various MSP-focused intrusions by state-nexus actors. The abuse of OAuth application identities and Microsoft Entra ID trust relationships aligns with techniques observed in campaigns like Midnight Blizzard's (APT29) Microsoft corporate email breach (January 2024) and various business email compromise operations exploiting cloud application permissions. ConnectWise itself has been a target of interest for threat actors, with previous vulnerabilities in ScreenConnect (CVE-2024-1709, CVE-2024-1708) exploited in February 2024. The October 2026 incident represents an evolution from product vulnerability exploitation to credential compromise of the vendor's own cloud application identities, demonstrating increased sophistication in MSP supply chain targeting.

Defensive Recommendations

  • Audit all Microsoft Entra ID (Azure AD) enterprise applications for unexpected client secrets, certificates, or permission grants added between October 14-17, 2026, particularly focusing on third-party MSP applications with high-privilege roles like Global Administrator (T1098, T1098.001)
  • Review Entra ID sign-in logs for authentication events from ConnectWise application IDs (506e08f9-6e9a-4da4-942b-a099a03644ae, 2399d300-6fca-4e6a-a686-399fefe75b83, and five others listed) and investigate any access to Exchange Online, SharePoint, Teams, or Graph API during the incident window
  • Implement conditional access policies requiring additional verification for high-privilege application role assignments and enforce application consent policies to prevent unauthorized OAuth grants (T1078.004 mitigation)
  • Monitor for anomalous API calls to Microsoft Graph, Exchange Online, and SharePoint from service principals, especially bulk data access patterns or directory enumeration (T1114.002, T1213.002 detection)
  • Revoke and rotate all access tokens, refresh tokens, and client secrets for ConnectWise applications in your tenant, and review application permission scopes to enforce least-privilege access for third-party MSP tools (T1199 mitigation)