ConnectWise named two more IPs. Searching only .128 will miss them.

At 18:45 UTC on 18 October ConnectWise added 144.172.64.99 and 144.172.64.60 from partner monitoring. Huntress put both on its IOC table. Cloud Backup, SaaS Security, and Cloud Management are still down, with no restoration time. Entra Free tenants lose 13 October sign-ins tomorrow.

RWP Ventures · 2026-10-19 · event 2026-10-15 · 15 min read · priority 9.2

Do not collapse five facts.

1. The new IPs are vendor-published hunt inputs, not a Huntress-observed second crawl. ConnectWise says they were “shared with us through downstream security monitoring of partner and customer environments.” Huntress labels them “additional IP indicator shared by ConnectWise.” They are not independently described as the source of the 15 October GUID-order sweep. Treat a hit as investigate, not as automatic confirmation that the 15 October actor used that address in that tenant.
2. A hunt that only greps .128 is now incomplete on the vendor’s own list. Yesterday the incomplete hunt was Azure IPv6. Overnight it is also two more IPv4s in the same /24. Filter all three. Then inspect non-Azure addresses and Azure private IPv6 in the same window.
3. The seven-app disable still does not clean the tenant. ConnectWise has not walked back the 18 October 01:00 UTC sentence: disabling those connections prevents new authentication; it does not reverse changes already made; previously issued tokens may remain usable until they expire; unauthorized credentials on separate identities still have to be found in your directory.
4. Entra Free tenants lose 13 October sign-ins tomorrow. ConnectWise’s review window starts 13 October. Entra ID Free retains audit and sign-in logs for seven days; a license upgrade does not recover expired history. 19 October is day six. Export service-principal sign-ins and audit JSON today.
5. This is still not a CVE, not ScreenConnect, and not OT process impact. ConnectWise still will not discuss attribution. Catalog freeze is unchanged at 2026.10.16 / 1748. CVE-2026-102764 (BeyondTrust Remote Support) and CVE-2025-61624 (Fortinet CLI path traversal) are due today — parallel federal clocks, not this story.

The operator sentence: add .99 and .60 to the service-principal hunt in every tenant you manage, export Free-tier logs before they age off 13 October, and do not treat a still-down backup service as a tenant all-clear.

Yesterday’s assessment is [the 18 October Daily Top](/posts/2026-10-18-connectwise-seven-apps-persistence/). The 17 October floor is [the SkyKick Daily Top](/posts/2026-10-17-connectwise-skykick-m365-oauth/). This article is the increment.

What happened

The abuse window is still 15 October. What changed overnight is the IOC list, the outage duration, and the log-retention clock.

ConnectWise, 18 October 18:45 UTC:

All three sit in AS14956 / RouterHosting space on Huntress’s original .128 attribution. Same /24 is not proof they are the same operator or the same phase. ConnectWise’s own 18 October technical workflow still says a matching event requires investigation; its result and subsequent activity determine the finding.

ConnectWise, 19 October 01:15 UTC:

• Containment remains in place. Since mitigations, ConnectWise has not observed successful threat activity in the environments it monitors. That clause is still about ConnectWise-held environments.
• Cloud Backup, SaaS Security, and Cloud Management remain suspended. Scheduled backups, archive access, and restores are unavailable. SaaS Security monitoring/alerting and Cloud Management user/license management are unavailable.
• No confirmed restoration time. Next update by 13:00 UTC on 19 October.
• Partners should follow the published technical investigation and remediation guide and keep affected applications disabled pending formal restoration instructions.

The Register, 19 October 05:31 UTC, restates the service interruption and Huntress’s persistence finding. It does not add a new victim count or a new Application ID.

Huntress’s narrative updates still stop at 17 October 17:15 ET (almost 1,000 Entra tenants with sign-in activity from .128, over 300 successes; failed 16-tenant sector wave; planted secret on Huntress’s own app used seven times from Azure IPv6). Overnight Huntress did add .99 and .60 to the IOC table. That is republication of ConnectWise’s list, not a new Huntress census.

Why it matters

Yesterday the defender action was: verify all seven Application IDs, then hunt secrets, and do not stop at .128 because persistence used Azure IPv6. Overnight the vendor added two more IPv4s and the Free-tier clock became a today problem.

Three reasons this is still the daily.

First, IOC drift on a live OAuth supply-chain is an operational change, not a rewrite. Partners who grepped only .128 on Saturday will miss whatever ConnectWise’s downstream monitors saw on .99 and .60. Huntress putting those addresses on the same table as .128 is the independent researcher acknowledgment that the hunt set grew. It is not Huntress saying it watched those two addresses walk tenants in GUID order.

Second, the outage is now a backup-gap story as well as an identity story. Cloud Backup has been off since 17 October. ConnectWise still says stored archives are encrypted, isolated, and show no evidence of access. That statement does not cover live Microsoft 365 data, and it does not restore a recovery point. New or changed data since the suspend is outside existing backups. MSPs that had no second backup product are accumulating an unrecoverable window.

Third, Entra Free retention is a hard cut. Activity of interest starts 13 October (password spray) and 15 October (app authentications and T1098.001). Seven-day Free retention means 13 October records age off 20 October. Tenants that have not exported service-principal sign-ins and audit JSON by close of 19 October will be arguing from a hole.

Who / what is affected

Technical context

RWP is not reproducing the client-credentials flow. The overnight increment is which addresses to query and which logs expire today.

Huntress still maps the observed activity to T1078.004 (valid cloud accounts — the publisher credential), T1098.003 (additional cloud roles), and T1098.001 (additional cloud credentials). Microsoft Threat Intelligence’s 17 October classification is unchanged: an active supply-chain attack on a trusted multi-tenant OAuth app.

The seven Application IDs are unchanged from [yesterday](/posts/2026-10-18-connectwise-seven-apps-persistence/):

Match on Application ID. Older tenants may still show SkyKick Cloud Manager display names.

Threat / exploitation status

Confidence on the two new IPs as published hunt indicators: high. Confidence that .99 / .60 were used in the 15 October GUID-order sweep: low until a tenant log shows them on those authentications. Confidence on the continued outage and the seven-app disable: high as vendor statements. Confidence that 300 is the global victim count: low. Confidence on actor identity: none. Confidence on confirmed data theft versus logging gap: low as confirmed theft, moderate as potential exposure given the grant.

What defenders should do

1. Widen the IP filter before you export. Service-principal sign-ins for each of the seven Application IDs, 13 October through now. Filter 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60. Then inspect non-Azure addresses, then inspect Azure private IPv6 in the same window rather than clearing it as “vendor.” A hit on .99 or .60 is investigate, not auto-confirm.
2. Export Entra Free logs today. Download audit JSON and each sign-in category (interactive, non-interactive, service principal, managed identity). Purview audit as well. Free retention is seven days; 13 October ages off 20 October. A P1/P2 upgrade does not recover what already expired.
3. Verify all seven Application IDs in every tenant you manage — MSP tenant and every customer, including dormant SkyKick connections. Entra → Enterprise applications → All applications → search by ID. If an affected app is still enabled, set Enabled for users to sign-in = No. Do not delete as the first response. Record Object ID, who changed it, and UTC time.
4. Hunt credentials on every other enterprise application and app registration, especially MSP, backup, RMM, and security tools, for secrets, certificates, or federated credentials added since 13 October that you did not create. Include Huntress Security Platform if you use Huntress. Disable does not remove those. ConnectWise does not have access to make those changes inside your tenant.
5. Review directory roles held by applications. Prioritize Global Administrator, Privileged Role Administrator, Privileged Authentication Administrator, Application Administrator, Cloud Application Administrator, Exchange Administrator, SharePoint Administrator. Hunt mailbox forwarding, hidden inbox rules (Get-InboxRule -IncludeHidden), transport rules, and delegated access.
6. Do not re-enable any of the seven until ConnectWise publishes reconnection instructions that include publisher-credential rotation. “No successful threat activity in the environments we monitor” is not an all-clear for your tenant. Tokens already issued may survive the disable until they expire.
7. Tell customers backups — and, where they used them, SaaS Security alerting and Cloud Management license changes — are still paused. Mail, Teams, and user sign-in keep working. Decide whether the recovery-point gap needs a second backup product before anyone re-enables.
8. Keep the other clocks. CVE-2026-102764 (BeyondTrust Remote Support, ARMORY CASTLE) and CVE-2025-61624 (Fortinet FortiOS/PAM/Proxy/SwitchManager authenticated CLI path traversal) are due today, 19 October, forensicTriage: Yes. Those are catalog clocks on the [16 October Daily Top](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/), not this story. CVE-2026-21589 was due 18 October. Catalog freeze is still 2026.10.16 / 1748. Do not steal the Entra owner for a FortiGate ticket.

RWP assessment

Score 9.2.

This is a material development on [yesterday’s seven-app Daily Top](/posts/2026-10-18-connectwise-seven-apps-persistence/), not a rewrite of it. Overnight ConnectWise added two IPv4 indicators from partner monitoring, Huntress put them on the IOC table, the three SkyKick-family services stayed down with no restoration time, and Entra Free retention became a same-day export problem. Evidence quality is high on those four increments as statements of those sources. Evidence quality is intentionally split on whether .99 / .60 were used in the 15 October sweep, on victim census, on confirmed data theft versus logging gap, and on actor identity.

It outranks BeyondTrust CVE-2026-102764 due today and Fortinet CVE-2025-61624 due today because both were Daily Top or cataloged on 16 October, the KEV JSON is still freeze 2026.10.16 / 1748, and a due date is a federal clock, not a new technical finding. It outranks Quentin Kaiser’s Broadcom WPS forever-day (Hexacon 16 October, The Hacker News 19 October) because that research has no CVE, no confirmed in-the-wild use, and is a radio-range SOHO/ISP-gateway finding — real, not this morning’s enterprise identity incident. It outranks the OpenCode Console provider-key breach (1.4% of Console users, OpenAI/Anthropic/Google keys, disclosed 17 October) as a real AI-supply-chain incident with a smaller, developer-scoped blast radius. It outranks unexploited criticals in this window (FortiSIEM CVE-2026-106173, Splunk Patroni CVE-2026-76268, Juniper J-Web CVE-2026-101954) because none is on KEV and none has confirmed exploitation in this retrieval.

What we are not saying: that .99 and .60 were the 15 October GUID-order source; that 300 tenants had mail stolen; that the 16 sector tenants were breached; that the actor is a named state; that ConnectWise backup archives are independently verified clean; that SaaS Security or Cloud Management were confirmed compromised; that ScreenConnect is in this incident; that this is a CVE; that this is OT process impact; that ransomware is Known.

What we are watching

• ConnectWise’s 13:00 UTC 19 October update: restoration timeline, or confirmation that the publisher secret was rotated.
• Tenant logs that show .99 or .60 on service-principal authentications for the seven Application IDs — that would promote those IPs from “vendor-shared” to “observed in the same campaign.”
• Whether Huntress or Microsoft publishes a census above 300, or a new narrative update after 17 October 17:15 ET.
• How many tenants besides Huntress’s one show T1098.001 on MSP or security-platform apps.
• Entra Free log expiry on 20 October.
• Attribution. ConnectWise still will not discuss it. Sector targeting stays targeting.
• Parallel clocks: BeyondTrust 102764 and Fortinet 61624 due today. Catalog freeze 2026.10.16 / 1748.

Sources

• ConnectWise — Trust Center advisories, updated 19 October 2026 01:15 UTC
• Huntress — ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
• ConnectWise — Cloud Backup status incident
• The Register — ConnectWise turns off SaaS backup, security, and management, 19 October 2026
• The Hacker News — ConnectWise Suspends Cloud Backup, 18 October 2026
• Todyl — Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App
• Microsoft Threat Intelligence — OAuth app supply-chain tracking, 17 October 2026
• CISA KEV JSON catalog 2026.10.16
• CISA — Adds Two Known Exploited Vulnerabilities, 16 October 2026
• CISA — Urges Patching BeyondTrust Remote Support, 16 October 2026
• Fortinet — FG-IR-26-122
• [RWP — ConnectWise seven-app disable, 18 October 2026](/posts/2026-10-18-connectwise-seven-apps-persistence/)
• [RWP — ConnectWise SkyKick, 17 October 2026](/posts/2026-10-17-connectwise-skykick-m365-oauth/)
• [RWP — BeyondTrust CVE-2026-102764, 16 October 2026](/posts/2026-10-16-beyondtrust-cve-2026-102764-armory-castle/)
• [RWP — Atlassian CVE-2026-21589, 6 October 2026](/posts/2026-10-06-atlassian-cve-2026-21589-file-access/)