ConnectWise Cloud Backup app abused — Huntress: sign‑in activity in almost 1,000 Entra tenants (300+ successes); ConnectWise disabled seven app identities (07:00 UTC, 17 Oct 2026); security.io reports certificate revocations
Event summary
Huntress reported on 17 Oct 2026 that almost 1,000 Microsoft Entra tenants had sign‑in activity from IP 144.172.64[.]128, with 'more than 300' successful sign‑ins. ConnectWise states it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026; security.io reports that affected certificates were revoked. These items indicate large‑scale sign‑in activity and vendor containment actions now posted publicly.
CHRONOS Wire · October 20 · Alert 5
Publication details
- Published
- Updated
- Revision
- r1
- Source
- Huntress
Cliff Notes
- Huntress: almost 1,000 Entra tenants with sign‑in activity from 144.172.64[.]128; >300 successful sign‑ins. ConnectWise: disabled seven application identities at 07:00 UTC on 17 Oct 2026. Security.io reports certificate revocations.
U.S. Impact
U.S. Impact assessment pending.
ELI5: Plain-English Explanation
Huntress observed sign-in activity from IP 144.172.64[.]128 in almost 1,000 Microsoft Entra tenants with more than 300 successful sign‑ins. ConnectWise disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026; an independent article (security.io) reports ConnectWise also revoked affected Cloud Backup certificates.
Why Urgent Level 4
Large number of observed sign‑ins across Entra tenants and vendor containment actions indicate an ongoing supply‑chain related incident; orgs using the ConnectWise Cloud Backup service should monitor vendor guidance and IOCs immediately.
What Changed
Huntress published expanded telemetry on 17 Oct 2026 reporting almost 1,000 Entra tenants with sign‑in activity from 144.172.64[.]128 and more than 300 successful sign‑ins. ConnectWise posted that it disabled seven ConnectWise application identities at 07:00 UTC on October 17, 2026. Security.io coverage reports that affected certificates were revoked.
What Is Genuinely New
Huntress published expanded telemetry on 17 Oct 2026 reporting almost 1,000 Entra tenants with sign‑in activity from 144.172.64[.]128 and more than 300 successful sign‑ins. ConnectWise posted that it disabled seven application identities at 07:00 UTC on October 17, 2026. Security.io reported that affected certificates were revoked.
CHRONOS Bottom Line
Widespread sign‑in activity tied to one IP was reported across ~1,000 Entra tenants with 300+ successful sign‑ins; vendor containment (disabling seven app identities) was put in place by ConnectWise on 17 Oct 2026 and an independent report indicates certificates were revoked.
Uncertainties / Known Unknowns
Huntress telemetry reflects observed sign‑ins but does not enumerate confirmed tenant compromises (persistence or privilege escalation). The precise scope of tenants with post‑sign‑in malicious changes is unknown from the published excerpts.
Detailed Analysis
Huntress reported almost 1,000 Entra tenants with sign‑in activity from IP 144.172.64[.]128 and more than 300 successful sign‑ins (Huntress, 17 Oct 2026). ConnectWise’s Trust Center advisory states that at 07:00 UTC on October 17, 2026 it disabled seven ConnectWise application identities. Security.io’s coverage reports that affected certificates were revoked. The published material documents expanded telemetry counts and vendor containment actions but does not quantify confirmed tenant compromises or enumerate post‑sign‑in changes across tenants.
Sources / Evidence
- 01
- 02Trust Center | Advisories | ConnectWiseConnectWise (Trust Center)2026-10-16
- 03ConnectWise application-identity abuse turns backup trust into a Microsoft 365 incident — Security.iosecurity.io (coverage of vendor/Huntress posts)2026-10-19
Follow CHRONOS ALERTS
Published alerts also appear on Instagram and Threads as @chronosalerts.