Timelines assembled after an incident tend to acquire certainty they never had. A blog post says two and a half hours, a vendor statement says twelve hours, and by the third retelling the sequence is presented as a reconstruction of a single actor's movement.

For the ConnectWise Cloud Backup incident, the public evidence supports a narrower and more useful account. Here it is, ordered, with each element attributed and the gaps left visible.

The sequence as documented

13 to 14 October. Password spraying against four law firm tenants, and scripted sign-in attempts, originate from the address later associated with the tenant intrusion. Reported by Huntress. The investigator has not tied this phase to the same operator as what follows.

15 October. The ConnectWise Cloud Management application for Microsoft Teams adds itself to the Global Administrator role in one customer tenant. It then runs a Python script that creates new client secrets on an MSP management application and on Huntress's own application. This activity came from Microsoft's internal cloud network, roughly two and a half hours before the first sign-ins from the attacker address.

15 October, 06:13 to 08:34 UTC. Microsoft Graph tokens are obtained in customer tenants from 144.172.64[.]128. The actor moves through tenants in sorted GUID order, seconds apart, consistent with a script working from a prepared target list.

15 to 16 October. The Cloud Backup identity signs in to 162 Microsoft 365 tenants.

17 October. ConnectWise suspends Cloud Backup, roughly twelve hours after starting its investigation. Huntress reports sign-in activity from the attacker address in nearly 1,000 Entra tenants by this date, with more than 300 successful.

18 October. SaaS Security and Cloud Management are shut down as well, to implement mitigations.

What the ordering tells an investigator

The Global Administrator self-assignment preceded the first sign-ins from the attacker address, and it did not come from that address. Assembling a tenant timeline therefore requires two independent filters: one on the attacker address, and one on service principal sign-ins regardless of source address. A log review built only on the reported IP would miss the role change entirely.

The creation of new client secrets matters for a different reason. Secrets extend the window. An investigation that concludes when the vendor blocks the credential may still be inside the period during which a secondary credential remains valid, which is why the vendor's guidance asks partners to check for persistence rather than only for access.

The tenant iteration pattern

Sorted GUID order at a few seconds per tenant is not human behaviour. It indicates a prepared list and an automated loop, which in turn indicates that the actor knew which tenants held the application consent before starting. That is a reconnaissance finding, and it is the most transferable part of the timeline for defenders: the enumeration that made the intrusion efficient is the same enumeration a defender should perform on their own estate before it is done for them.

External context, dated

Search observations collected on 28 October 2026 do not extend the timeline but do frame the observable estate. domain="connectwise.com" returned 170 records; domain="connectwise.com" && country="US" returned 141; ip="144.172.64.128" returned 0, indicating no indexed host at that address at query time. The zero is consistent with an address used for authentication rather than for hosting a service, and it neither supports nor refutes the reported activity.

Gaps in the record

What the public evidence does not establish: whether any tenant data was copied; whether the two October phases share an operator; which organisations were among the 162 and the 300-plus; and how long any secondary credentials created during the intrusion remained valid in each tenant. ConnectWise has not published an estimated restoration timeline, and no source reviewed for this article provides a complete affected-tenant list.

Recording those gaps is not pedantry. A timeline that omits them invites decisions based on an assumed completeness that the record does not carry.

References

  • Huntress, "Vendor Credential Enables Unauthorized Access", https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access

  • SecurityWeek, "ConnectWise Suspends Cloud Services in Response to Cyberattack", https://www.securityweek.com/connectwise-suspends-cloud-services-in-response-to-cyberattack/

  • ConnectWise status incident notice, https://status.connectwise.com/pages/incident/619cf82551fec9053d612f09/6ad263692dc48705ab3da2cb

  • ConnectWise trust advisories, https://www.connectwise.com/company/trust/advisories