UPDATE — ConnectWise disabled seven app identities; vendor reports “significant progress” restoring access to “more than several thousand MSPs”; Microsoft: attackers “likely abused…Directory.ReadWrite.All”
Event summary
ConnectWise disabled seven impacted application identities as part of containment. The vendor says it has made “significant progress” toward restoring access to “more than several thousand MSPs.” Microsoft reported attackers “likely abused permissions…including highly elevated permissions like Directory.ReadWrite.All.”
CHRONOS Wire · October 20 · Alert 8
Publication details
- Published
- Updated
- Revision
- r2
- Source
- CRN
Cliff Notes
- Seven ConnectWise app identities disabled; vendor reports progress restoring access to “more than several thousand MSPs”; Microsoft reports likely abuse of Directory.ReadWrite.All. Monitor vendor advisories and tenant logs.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
ConnectWise disabled seven application identities after a supply-chain incident affecting its Cloud Backup integration with Microsoft 365. The vendor says it has made “significant progress” toward restoring access for “more than several thousand MSPs,” and Microsoft said attackers “likely abused permissions…including Directory.ReadWrite.All.”
Why Urgent Level 4
Confirmed containment actions (seven app identities disabled) and Microsoft reporting likely elevated-permission abuse create immediate risk of tenant-level persistence and operational disruption; affected parties should monitor advisories and investigate sign-ins and app permissions now.
What Changed
ConnectWise reported progress toward restoring Microsoft 365 access for “more than several thousand MSPs” while having disabled seven ConnectWise application identities as part of containment; Microsoft said attackers “likely abused permissions…including Directory.ReadWrite.All.”
What Is Genuinely New
ConnectWise communicated progress toward restoring access for “more than several thousand MSPs” after disabling seven ConnectWise application identities; Microsoft reported that threat actors “likely abused permissions previously granted by customers…including Directory.ReadWrite.All.”
CHRONOS Bottom Line
ConnectWise disabled seven application identities and reports progress restoring access to “more than several thousand MSPs”; Microsoft reported likely abuse of elevated permissions (Directory.ReadWrite.All).
Uncertainties / Known Unknowns
Whether attackers accessed backup data or maintained persistent tenant-level access in all affected tenants remains under investigation; available statements do not confirm data exfiltration.
Detailed Analysis
ConnectWise disabled seven application identities (Trust advisory) as part of containment. The vendor told press it has made “significant progress” toward restoring access for “more than several thousand MSPs” (CRN). Microsoft told reporters that threat actors “likely abused permissions previously granted by customers…including highly elevated permissions like Directory.ReadWrite.All” (The Record). These statements update the status of the ongoing ConnectWise Cloud Backup supply-chain incident but do not confirm tenant data exfiltration.
Sources / Evidence
- 01
- 02Trust Center | Advisories | ConnectWiseConnectWise (Trust Center)2026-10-19
- 03ConnectWise suspends Cloud Backup service after supply chain attackThe Record (Recorded Future)2026-10-19
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.