ConnectWise application identities disabled after sign‑ins from 144.172.64.128; Huntress: ~1,000 Entra tenants saw sign‑ins, >300 succeeded
Event summary
Huntress reports almost 1,000 Entra tenants had sign‑in activity from IP 144.172.64.128 and that over 300 of those sign‑ins succeeded. ConnectWise states it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026 and lists the same IP. Tenants should immediately preserve Entra sign‑in and audit logs and hunt for service‑principal activity.
CHRONOS Wire · October 18 · Alert 7
Publication details
- Published
- Updated
- Revision
- r1
- Source
- Huntress
Cliff Notes
- Huntress: ~1,000 Entra tenants saw sign‑ins from 144.172.64.128; >300 succeeded. ConnectWise disabled seven application identities at 07:00 UTC on Oct 17, 2026. Preserve and export Entra sign‑in/audit logs and hunt now.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
Sign-ins from IP 144.172.64.128 were observed against many Microsoft Entra (Azure AD / M365) tenants. Huntress reports almost 1,000 tenants saw activity (over 300 successful sign‑ins), and ConnectWise says it disabled seven ConnectWise application identities after identifying the suspicious IP. Tenant owners should preserve sign‑in and audit logs and hunt for service‑principal activity.
Why Urgent Level 4
High-volume scripted sign‑ins across hundreds of tenants with vendor action to disable application identities mean potential active access and narrow forensic windows; tenants must preserve logs and investigate immediately.
What Changed
Huntress published counts showing almost 1,000 Entra tenants had sign‑in activity from 144.172.64.128 and over 300 of those sign‑ins succeeded. ConnectWise reports it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026 and lists the same suspicious IP.
What Is Genuinely New
Huntress's telemetry (Oct 17) shows almost 1,000 Entra tenants had sign‑in activity from 144.172.64.128 with over 300 successful sign‑ins. ConnectWise (Trust Center) reports it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026 and identifies the same IP.
CHRONOS Bottom Line
High-volume service-principal sign‑in activity from IP 144.172.64.128 affected almost 1,000 Entra tenants (over 300 successful). ConnectWise disabled seven application identities on Oct 17; tenants should preserve Entra sign‑in/audit logs and hunt for unauthorized service‑principal activity immediately.
Uncertainties / Known Unknowns
Whether attackers accessed or exfiltrated tenant data where sign‑ins succeeded is not confirmed in available sources; ConnectWise does not report per‑tenant access findings in the advisory.
Detailed Analysis
Huntress telemetry identifies almost 1,000 Entra tenants with sign‑in activity from IP 144.172.64.128 and reports over 300 successful sign‑ins. ConnectWise's Trust Center states it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026 and lists the same IP. The evidence supports widespread scripted sign‑in activity tied to that IP and vendor action to disable application identities; sources do not state whether backup archives or tenant data were accessed or exfiltrated.
Sources / Evidence
- 01ConnectWise (SkyKick) Vendor Credentials Abused in M365 AttacksHuntress2026-10-17
- 02ConnectWise Cloud Backup investigation and service updateConnectWise Trust Center2026-10-18
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.