Huntress: almost 1,000 Entra tenants had sign‑in activity from 144.172.64[.]128; over 300 sign‑ins succeeded
Event summary
Huntress reported that almost 1,000 Microsoft Entra tenants showed sign-in activity from IP address `144.172.64[.]128`, and that over 300 of those sign-ins succeeded. The finding indicates large-scale unauthorized sign-in activity observable to that investigator; vendor confirmation, exact dates/timeline, and whether data loss occurred are not confirmed in the retrieved source.
CHRONOS Wire · October 18 · Alert 6
Publication details
- Published
- Updated
- Revision
- r1
- Source
- Huntress
Cliff Notes
- Huntress: almost 1,000 Entra tenants had sign-ins from 144.172.64[.]128; over 300 successful.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
A security researcher (Huntress) found sign-in activity from a single IP (144.172.64[.]128) into almost 1,000 Microsoft Entra tenants, with over 300 of those sign-ins succeeding. This suggests a vendor-related credential or automation was used to access many tenants; admins should check app/service-principal sign-ins and credentials.
Why Urgent Level 4
Huntress observed hundreds of successful sign-ins across many tenants; administrators should immediately audit service-principal/app sign-ins and investigate any unusual app registrations or credentials to detect and remediate potential unauthorized access.
What Changed
Huntress published that almost 1,000 Entra tenants had sign-in activity from the single IP 144.172.64[.]128 and that over 300 of those sign-ins succeeded, providing a quantified scope visible to that investigator.
What Is Genuinely New
Huntress's Oct 17 post reported almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128 and that over 300 of those sign-ins succeeded — a quantified scope from that investigator.
CHRONOS Bottom Line
Huntress observed sign-in activity from IP 144.172.64[.]128 into almost 1,000 Entra tenants, with over 300 successful sign-ins; administrators should immediately audit service-principal and app-only sign-ins and investigate unexpected app registrations or credentials.
Uncertainties / Known Unknowns
Only Huntress has published the quantified sign-in counts so far; attribution to a specific vendor credential, exact timeframe of the sign-ins, and whether data exfiltration occurred are not publicly confirmed in the cited source.
Detailed Analysis
Huntress reports identification of almost 1,000 Entra tenants with sign-in activity from IP 144.172.64[.]128 and that over 300 of those sign-ins succeeded. The post frames this within vendor-credential–related activity in M365 attacks, but the retrieved excerpt does not include vendor confirmation, exact timestamps, or corroboration from additional independent sources.
Sources / Evidence
- 01ConnectWise (SkyKick) Vendor Credentials Abused in M365 AttacksHuntress2026-10-17
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.