ConnectWise Investigates Compromised Cloud Backup Application Credentials Used in Microsoft 365 Tenants
Summary
A compromised ConnectWise application credential was used to request Microsoft 365 access tokens. Huntress reported activity in nearly 1,000 Entra tenants, but that does not mean all were compromised; data access remains unconfirmed.
Key points
- Huntress observed suspicious authentication from 144.172.64[.]128 and reported activity in nearly 1,000 Entra tenants, including more than 300 successful authentications.
- The credential was vendor-controlled and could obtain tokens with permissions previously granted to ConnectWise applications; the original exposure method is unknown.
- In one investigated tenant, the Cloud Management – MS Teams application assigned itself Global Administrator privileges and modified two trusted applications, adding credentials later used for sign-ins.
- ConnectWise disabled seven application identities, revoked certificates for affected Cloud Backup connections, and suspended Cloud Backup, SaaS Security, and Cloud Management. Services remained suspended in the latest update described.
- ConnectWise said stored Cloud Backup archives remained encrypted and showed no evidence of access; that does not establish whether live customer tenants were accessed or data was read.
- Organizations should review service-principal sign-ins, application credentials, permissions, role changes, and audit records from October 13 onward, extending to October 1 where logs are available.
Article Details
- Victim Organization
- ConnectWise
- Incident Type
- Unauthorized access to ConnectWise Cloud Backup application identities using a compromised vendor-controlled application credential, with suspicious authentication activity in customer Microsoft 365 tenants and observed persistence changes in one tenant.
- Incident Date
- 2024-10-15
- Disclosure Date
- 2024-10-16
- Data Types Exposed
- Potentially accessible mailboxes, OneDrive and SharePoint files, Teams information, and directory data; actual data access or theft was not established.
- Operational Impact
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management. Scheduled backups, archive access, restores, SaaS Security monitoring and alerting, and Cloud Management user and license management were unavailable as of the latest status update early October 19. No confirmed restoration time was provided.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]172[.]64[.]128 | Identified by Huntress as suspicious authentication infrastructure used in activity involving the ConnectWise Cloud Backup application; also associated with early password spraying. |
Vendors
Products
Azure Resource ManagerA later sweep appeared more manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs. The activity has not been attributed to a known threatCloud Managementsubsequently disabled seven application identities and suspended Cloud Backup, SaaS Security, and Cloud Management while investigation and remediation continue.ConnectWise Cloud BackupConnectWise Cloud Backup Breach: What We KnowEntraconfirmed unauthorized sign-ins in 162 tenants. Its October 17 update said it had identified almost 1,000 Entra tenants with sign-in activity from 144.172.64[.]128, with more than 300 successful authentications.Exchange Onlinesought Graph tokens through the SkyKick application. A later sweep appeared more manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs. TheMicrosoft 365 Apps for EnterpriseBackup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments.Microsoft GraphA vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspendedOffice 365 Management APIsand targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs. The activity has not been attributed to a known threat actor.SaaS Securitytenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS Security, and Cloud Management while investigation and remediation continue.SharePoint Onlinethrough the SkyKick application. A later sweep appeared more manual and targeted Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs. The activity has not beenTeamsDepending on each tenant’s configuration, these can include mailboxes, OneDrive and SharePoint files, Teams information, and directory data.
Tools
Industries
National securityInvestigators identified a second wave on October 15 involving 16 tenants in policy, national security, trade, and critical mineral sectors. Most did not use ConnectWise products, and attempts failed where the requiredPolicyInvestigators identified a second wave on October 15 involving 16 tenants in policy, national security, trade, and critical mineral sectors. Most did not use ConnectWise products, and attempts failed where the requiredTradeInvestigators identified a second wave on October 15 involving 16 tenants in policy, national security, trade, and critical mineral sectors. Most did not use ConnectWise products, and attempts failed where the required