ConnectWise’s Credential
ConnectWise’s 18 October, 01:00 UTC update reports seven identities disabled at 07:00 UTC, 17 October. Certificates were revoked; issued tokens can remain usable.
Cloud Backup jobs, archive access and restores remain suspended. SaaS Security monitoring/alerts and Cloud Management user/licence administration are also paused as precautions, not proof of compromise. Restoration timing is unknown. Encrypted archives show no evidenced access, not a downstream-tenant clearance.
What the investigations establish
Huntress’s 17 October update counts almost 1,000 tenants with activity from 144.172.64.128, over 300 with successes, within its visibility. These are sign-ins, not confirmed exfiltration. Separately, 15 October’s wave failed against 16 tenants, mostly without ConnectWise products.
In one tenant, Teams gained Global Administrator and planted two secrets. The Huntress secret was removed on 16 October after seven sign-ins; unlogged reads remain possible. Both researchers established vendor-credential, app-only access with inherited permissions, outside user MFA.
Todyl’s 16 October findings remain distinct: no persistence through the backup app in reviewed tenants; nine inactive-subscription tenants without subsequent mail/file-read records; active-backup reads unattributable. It gives issued tokens up to 90 minutes.
Match application IDs, not names
- Cloud Backup:
506e08f9-6e9a-4da4-942b-a099a03644ae - Cloud Management:
2399d300-6fca-4e6a-a686-399fefe75b83 - Teams:
24205314-2b89-4e07-a2a4-579e898a5640 - Exchange Online:
b78f6a77-d4e5-46fb-87e5-d1648bd02519 - MS Graph:
0de14c77-b9b0-4137-9360-34878a929827 - Partner Center:
412dcf96-176d-4b3a-a1b0-4981ad66971e - SharePoint Online:
b2b55f5b-7758-4719-8d8f-88ae172e6bdb
Follow the vendor workflow from 13 October in every tenant, including dormant connections: preserve interactive, non-interactive, service-principal and managed-identity sign-ins and audit records. Keep apps disabled, not deleted; inspect credentials and federation trusts, roles, owners and consent, policy and mailbox forwarding, rules and delegation. Await formal restoration instructions. Changes may fall outside existing recovery points.
Who owns the next decision?
The vendor has not explained credential acquisition. Incomplete logs cannot establish an all-clear. An administrator should be able to tell the next shift which conclusion is supported and which remains unanswered.
BlackTree proposes a short handover record: the decision, its named owner, the evidence supporting it and the unanswered question that could change it. Assign a separate owner to the recovery decision. Do not let an incident-response task marked finished silently answer a different question about whether a business service can safely resume.
