ConnectWise Disables Application Identities Following Microsoft 365 Tenant Compromise

ConnectWise announced on Saturday that it has disabled seven ConnectWise application identities as it continues its investigation into an incident involving unknown threat actors. According to the report, the threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities include ConnectWise Cloud Backup (ID: 506e08f9-6e9a-4da4-942b-a099a03644ae) and six others. The company stated that the disabling of these identities is a precautionary measure while the investigation progresses. The exact method of initial access used by the threat actors has not been specified in the report. The incident affects the ConnectWise Cloud Backup service and Microsoft 365 environments globally. No specific patch has been released; the immediate mitigation action taken was the disabling of the compromised application identities. The investigation into the full scope of the compromise and the identity of the threat actors is pending further updates.