INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Exploit Compromised ConnectWise Credentials to Target Microsoft 365

| 2026-10-17 10:55 LOW HIGH DATA BREACH
JSON
Executive Summary
AI-generated
On October 17, 2026, hackers exploited compromised ConnectWise Cloud Backup credentials to gain unauthorized access into 173 Microsoft 365 accounts. The attackers leveraged a stolen credential to sign in through a trusted backup application, compromising the security of multiple organizations. This incident highlights the risks associated with multitenant applications and vendor secrets, as one leaked secret can create vulnerabilities across many organizations. Cyber Security News reported that hackers targeted Microsoft 365 partner and customer tenants using compromised credentials from ConnectWise Cloud Backup, resulting in unauthorized access to 173 accounts within the Microsoft ecosystem.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 3 IoCs Create Free Account
hxxp://••••••••••••••••••••
ww•••••.com
144.172.•••.•••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎2026/10/17
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants.
infrastructure Microsoft 365
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts.
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application.
The affected product is ConnectWise Cloud […] The post Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts appeared first on Cyber Security News .
organisation Compromised ConnectWise Backup
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts.
organisation Hack 173
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts.
organisation Microsoft
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts.
organisation Cyber Security News
The affected product is ConnectWise Cloud […] The post Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts appeared first on Cyber Security News .
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts.
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application.
The affected product is ConnectWise Cloud […] The post Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts appeared first on Cyber Security News .
Intelligence Sources
AlienVault OTX 2026-10-17