ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

ConnectWise said on Saturday it has disabled seven of its application identities and suspended its Cloud Backup service by revoking certificates, as it investigates attackers' unauthorized access to those identities and to customers' Microsoft 365 tenants. Huntress said it has identified almost 1,000 Entra tenants with sign-in activity from the IP address linked to the activity, about 300 of them successful, and a second targeted wave of attempts on October 15 against 16 tenants in the policy, national security, trade, and critical mineral sectors.