ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services following a supply chain attack in which threat actors exploited compromised application credentials to gain unauthorized access to customer Microsoft 365 environments. According to Huntress, malicious activity dating back to October 13, 2026, involved nearly 1,000 Microsoft Entra tenants, with more than 300 successful authentications, although not all resulted in confirmed compromises. Attackers abused trusted application identities and existing permissions to bypass traditional MFA protections, obtain Microsoft Graph access tokens, and potentially access sensitive emails, SharePoint documents, OneDrive files, and Teams communications. Researchers also observed privilege escalation to Global Administrator and persistence mechanisms involving unauthorized client secrets added to trusted applications, although some activity could not be conclusively attributed to the same threat actor. A second, targeted wave of unsuccessful intrusion attempts focused on sixteen (16) tenants in the policy, national security, trade, and critical minerals sectors. The activity was associated with IP addresses 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60. In response, ConnectWise disabled seven (7) application identities and revoked affected credentials, reporting no evidence that encrypted customer backup archives were compromised or that malicious activity continued in its monitored environments following containment. However, scheduled backups, restoration capabilities, security monitoring, and cloud management functions remain unavailable, with no announced restoration timeline. CTIX analysts urge organizations to review Microsoft Entra authentication logs, audit application permissions and administrative role changes, and remove unauthorized credentials or persistence mechanisms, as previously issued access tokens and malicious configurations may remain active despite the service shutdown.