ConnectWise Suspends Cloud Services After Compromised Credential Is Used to Access Microsoft 365 Tenants
Summary
ConnectWise suspended three cloud services after a compromised credential was used to access Microsoft 365 tenants. Huntress observed sign-ins across 162 tenants and reported nearly 1,000 Entra tenants with activity by October 17.
Key points
- ConnectWise shut down Cloud Backup on October 17 and SaaS Security and Cloud Management the following day as a containment measure.
- Huntress said the compromised Cloud Backup credential accessed 162 Microsoft 365 tenants between October 15 and 16.
- By October 17, Huntress had identified activity from the attacker’s IP in nearly 1,000 Entra tenants, with more than 300 successful sign-ins; successful sign-in did not always mean access.
- In one tenant, Huntress observed a ConnectWise app add itself to the Global Administrator role and create client secrets for management applications.
- Huntress said it had not tied that activity to the same operator as the later sign-ins from the attacker’s IP.
- The shutdown disrupted scheduled backups, archive access, restores, SaaS Security monitoring and alerting, and Cloud Management user and license management; ConnectWise gave no restoration timeline.
- ConnectWise said customer backups remained encrypted and protected and that it had no evidence of unauthorized access to them; it shared IP information and guidance for reviewing Microsoft 365 environments.
Article Details
- Victim Organization
- ConnectWise
- Incident Type
- Unauthorized access using a compromised credential, including access to customer Microsoft 365 tenants and password-spraying activity.
- Operational Impact
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services. Scheduled backups, archive access, restores, SaaS Security monitoring and alerting, and Cloud Management user and license management were affected. ConnectWise said customer backups remained encrypted and protected and that it had no evidence of unauthorized access to them.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | Huntress identified this as the attacker IP used to obtain Microsoft Graph tokens in customer tenants. |
MITRE ATT&CK
People
Vendors
ConnectWiseConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants.MicrosoftHowever, it has shared information on the IP addresses used in the intrusion and has published guidance for reviewing MSPs’ Microsoft 365 environments.
Products
Cloud ManagementConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants.ConnectWise Cloud BackupConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants.EntraBy October 17, the cybersecurity firm had identified sign-in activity from the attacker’s IP address in nearly 1,000 Entra tenants, with over 300 of the sign-ins being successful.Exchange OnlineHuntress says it is highly confident the threat actor also abused the ConnectWise Cloud Management Exchange Online, MS Teams, and SharePoint Online applications as part of the intrusions.Microsoft 365 Apps for EnterpriseHowever, it has shared information on the IP addresses used in the intrusion and has published guidance for reviewing MSPs’ Microsoft 365 environments.Microsoft GraphIt was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.Microsoft TeamsIn one customer tenant, Huntress observed the ConnectWise Cloud Management app for Microsoft Teams adding itself to the Global Administrator role on October 15, then running a Python script that added new client secretsSaaS SecurityConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants.SharePoint OnlineHuntress says it is highly confident the threat actor also abused the ConnectWise Cloud Management Exchange Online, MS Teams, and SharePoint Online applications as part of the intrusions.