ConnectWise Disables Cloud Backup After Credentials Used to Access Microsoft 365 Tenants
Summary
Credentials associated with ConnectWise Cloud Backup were used to authenticate to Microsoft 365 tenants. Huntress reported more than 300 successful sign-ins among over 1,000 tenants; ConnectWise says downstream compromise remains unconfirmed.
Key points
- ConnectWise said it identified unauthorized access to application identities associated with Cloud Backup on Oct. 14; its investigation is ongoing, and it has not confirmed vulnerability exploitation or attributed the activity to an attacker.
- ConnectWise disabled Cloud Backup, SaaS Security, and Cloud Management functions while investigating. It revoked affected certificates, rotated or disabled identified credentials and identities, and is monitoring authentication and reviewing permissions.
- Huntress reported sign-in activity across more than 1,000 Entra tenants from 144.172.64[.]128, with over 300 successful sign-ins.
- Huntress said that in two tenants, a ConnectWise application obtained Global Administrator access and added credentials to other applications, potentially enabling persistence.
- Todyl urged customers to presume compromise for tenants with the ConnectWise Cloud Backup application enabled. It said activity included partner tenants where the app had never been installed; ConnectWise has not confirmed whether partner data or tenant lists were exposed.
- ConnectWise says it has not identified confirmed downstream customer compromise or indicators that Cloud Backup partner backup data was compromised. It says it lacks independent visibility into customer Microsoft 365 environments.
- ConnectWise and the researchers advised customers to disable affected applications, review indicators and credentials across their own and managed customer tenants, and confirm data retention and restore options.
Article Details
- Victim Organization
- ConnectWise
- Incident Type
- Unauthorized access to application identities associated with ConnectWise Cloud Backup; downstream tenant impact remains disputed and under investigation.
- Data Types Exposed
- Application credentials
- Microsoft 365 API secret
- Operational Impact
- ConnectWise disabled Cloud Backup for partners and clients, and also disabled SaaS Security and Cloud Management. Backup, restore, SaaS Security monitoring, and Cloud Management functions remained unavailable.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | IP address linked by Huntress to sign-in activity associated with the unauthorized activity across Microsoft Entra tenants. |
MITRE ATT&CK
People
Vendors
ConnectWiseA threat actor used credentials associated with ConnectWise's Cloud Backup product to authenticate into Microsoft 365 tenants, according to multiple security firms, though the extent of downstream compromise remainsHuntressBy contrast, security firms Huntress and Todyl argued in respective security blog posts that successful authentication into customer tenants using the ConnectWise application's credentials itself constitutes downstreamTodylBy contrast, security firms Huntress and Todyl argued in respective security blog posts that successful authentication into customer tenants using the ConnectWise application's credentials itself constitutes downstream
Products
Cloud ManagementCloud Backup for partners and clients, and over the weekend it also disabled SaaS Security and Cloud Management as the investigation and remediation efforts continue. Backups, restores, SaaS Security monitoring,ConnectWise Cloud Backupweekend, ConnectWise shared details involving a possible supply chain incident and its product, ConnectWise Cloud Backup (formerly known as SkyKick). The software vendor, which primarily serves managed serviceMicrosoft 365 Apps for Enterprisethreat actor used credentials associated with ConnectWise's Cloud Backup product to authenticate into Microsoft 365 tenants, according to multiple security firms, though the extent of downstream compromise remainsMicrosoft Entrapresume compromise. "We can assume ALL tenants that have 506e08f9-6e9a-4da4-942b-a099a03644ae [the Microsoft Entra application ID for the ConnectWise Cloud Backup application, formerly SkyKick Backup] enabled areSaaS Securityon Oct. 17 then disabled Cloud Backup for partners and clients, and over the weekend it also disabled SaaS Security and Cloud Management as the investigation and remediation efforts continue. Backups, restores, SaaS
Industries
Managed service providersCloud Backup (formerly known as SkyKick). The software vendor, which primarily serves managed service providers (MSPs), said in its disclosure status post that it identified "unauthorized access toNational securityorganizations, followed by "a smaller, apparently more manual sweep of organizations in the policy, national security, trade, and critical mineral sectors, which was unsuccessful."Policyacross many organizations, followed by "a smaller, apparently more manual sweep of organizations in the policy, national security, trade, and critical mineral sectors, which was unsuccessful."Tradefollowed by "a smaller, apparently more manual sweep of organizations in the policy, national security, trade, and critical mineral sectors, which was unsuccessful."