Huntress analysts confirmed that threat actors successfully abused a Microsoft Teams application identity in at least one compromised tenant during the incident. This discovery prompted a swift and comprehensive response from the IT management provider, which officially disabled seven critical application identities on October 17. These identities, ranging from Cloud Backup to Exchange Online and SharePoint management tools, were found to be the primary vectors for unauthorized access into various Microsoft 365 environments. The breach was first detected on October 14 through advanced cybersecurity monitoring, leading to an immediate activation of internal and external incident response protocols. By revoking the certificates used for these connections, the company effectively blocked new authentication attempts, though it cautioned that previously issued access tokens could remain functional until their natural expiration. This incident highlights the vulnerability inherent in modern cloud integrations, where the theft of a single service principal credential can provide an attacker with high-level access to multiple downstream customer tenants without needing to compromise individual user passwords.
Step 1: Audit Environments and Application Status
A primary recommendation for security administrators involves a comprehensive audit of their own Microsoft 365 tenants and those of every managed customer. This process must include a thorough examination of all service principals and application integrations, specifically looking for any dormant or inactive connections, such as those related to SkyKick or other legacy management tools. Threat actors frequently exploit forgotten or unmonitored integrations to maintain a foothold within a cloud environment, making it essential to remove any unnecessary permissions or identities. The auditing process should focus on identifying unusual modifications to service principal properties, such as the addition of new client secrets or changes to the assigned directory roles. By maintaining a clean and well-documented list of approved applications, organizations can significantly reduce their attack surface. This level of scrutiny is necessary because central mitigation actions taken by a software provider do not automatically revert unauthorized changes that may have already been implemented by an attacker within a specific downstream tenant.
Following the initial audit, administrators must verify the status of the specific application connections identified in the breach report to ensure they remain deactivated. ConnectWise suspended its Cloud Backup service across all users as a precautionary measure, which included the revocation of certificates for identities related to Microsoft Graph, Partner Center, and Teams. While these services remain offline, scheduled backup operations are not running, and access to existing restoration capabilities is temporarily unavailable. It is vital for partners to confirm that these connections are disabled in their local Microsoft Entra ID instances to prevent any accidental re-exposure while the forensic investigation continues. The company has emphasized that existing backup archives remain encrypted and isolated, with no current evidence suggesting that the stored data itself was accessed by the threat actors. Maintaining this state of suspension is a critical component of the containment strategy, as it ensures that the credential-exposure mechanism cannot be further exploited while security teams work on a permanent remediation plan.
Step 2: Monitor Authentication Activity and Secure Audit Records
Deep log analysis is required to identify the extent of the unauthorized activity, specifically focusing on sign-in attempts starting from October 13 through the present. Administrators should look for any login events originating from the malicious IP address 144.172.64.128, which was linked to both automated and manual efforts to penetrate various tenants. This monitoring must be exhaustive, covering all workload identities and user accounts to detect any anomalies in how authentication tokens were requested or used. The threat actors were observed conducting targeted sweeps of high-value tenants, particularly those in the national security and critical minerals sectors, demonstrating a strategic intent beyond simple data theft. Identifying these malicious sign-ins early allows for a more focused investigation into the specific resources that may have been accessed or modified during the breach. Constant vigilance is required because the threat actors showed a high degree of technical skill in navigating Entra ID environments once they obtained a valid application credential, making detection through standard alerts more difficult.
Preserving the integrity of digital evidence is a foundational requirement before any containment or recovery steps are initiated by the security team. Organizations must capture and secure all available sign-in and audit records to provide a factual basis for the ongoing forensic analysis and any future regulatory reporting. These records serve as the definitive timeline of the incident, showing exactly when the initial compromise occurred and what subsequent actions the threat actor took to escalate their privileges. In many cases, cloud logs have limited retention periods, making it essential to export and archive this data into a secure, external location as quickly as possible. Having a pristine copy of the audit trail allows investigators to reconstruct the attack path and identify if any persistence mechanisms, such as new federation trusts or application credentials, were established. This step is crucial for ensuring that the full scope of the breach is understood, providing the necessary clarity to stakeholders regarding the potential impact on sensitive corporate information and the effectiveness of the proposed remediation actions.
Step 3: Evaluate Directory Permissions and Mailbox Configurations
A thorough assessment of directory roles and application permissions is essential to prevent the long-term exploitation of a compromised tenant. Attackers often attempt to expand their access by adding compromised identities to highly privileged roles, such as Global Administrator or Application Administrator. During this incident, the ability for an attacker to authenticate as a trusted application allowed them to potentially create new service principals or add client secrets to existing ones, creating a resilient backdoor. Administrators must review all recently granted permissions and consent grants to ensure that no unauthorized third-party applications have been weaponized to facilitate data exfiltration. By limiting the number of individuals and applications that hold administrative rights, organizations can significantly reduce the potential for lateral movement within the cloud environment. Implementing application management policies that cap the lifetime of credentials and restrict the types of secrets that can be added provides an additional layer of security that makes it much harder for a threat actor to maintain a persistent presence undetected.
The potential for data exfiltration through email is a major risk that must be addressed by inspecting all mailbox configurations for unauthorized changes. Security teams should look for new inbox rules, unauthorized mail forwarding settings, or modifications to delegated access permissions that could allow an attacker to monitor communications. These changes are often used to redirect sensitive information to external addresses, providing the threat actor with a continuous stream of intelligence even after their primary access has been revoked. The inspection should also include a review of transport rules and connectors that could be used for large-scale mail harvesting across the entire organization. Identifying and removing these unauthorized rules is a vital part of the recovery process, as it ensures the privacy and confidentiality of corporate communications. This task requires a detailed, mailbox-level review, as malicious rules can be easily hidden among legitimate ones or configured to run only under specific conditions. Restoring the integrity of the mail flow is a critical step in ensuring that the organization’s communication platform is once again secure.
Step 4: Investigate Secondary Identities and Future Considerations
The final stage of the incident response involves a deep investigation into any secondary identities that may have been created or modified during the period of unauthorized access. Threat actors often use their initial entry point to establish multiple alternative pathways, such as creating new user accounts or modifying the credentials of dormant ones. Every account that showed activity during the suspicious window must be treated as potentially compromised, requiring a comprehensive password reset and a verification of all multi-factor authentication settings. This step is necessary to close any remaining gaps in the security perimeter and to ensure that the remediation efforts have successfully removed all traces of the attacker’s presence. Administrators must also review all federation trusts and policy changes that occurred during the incident, as these can be used to bypass standard authentication controls. By meticulously verifying every identity within the directory, organizations can ensure that their environment is free of hidden persistence mechanisms and that the recovery process is truly complete, restoring full operational confidence.
Reflecting on the technical challenges of the incident, the industry adopted several proactive measures to strengthen the security of cloud-based application identities. Implementing Microsoft Entra ID Protection helped to flag risky service principals and provide automated responses to unusual sign-in behaviors. Organizations also moved toward more granular monitoring of API permissions, ensuring that every integration operated under the principle of least privilege. The incident highlighted the vital importance of regular, automated audits for all third-party connections and the need for stricter controls over who could grant administrative roles. Security teams were encouraged to utilize Conditional Access for workload identities to restrict where applications could sign in from, effectively nullifying many of the techniques used by the threat actors. These strategic enhancements transformed the collective approach to cloud security, shifting the focus toward a more resilient architecture that prioritized identity integrity. By integrating these solutions, the professional community established a more robust defense posture that effectively mitigated the risks associated with the compromise of a single service provider or application credential.