ConnectWise Resets Credentials After Cloud Backup Security Incident

Summary

ConnectWise says unauthorized access to Cloud Backup application identities prompted credential resets and other mitigations. Huntress observed post-compromise activity in two tenants, including new application secrets; ConnectWise says Cloud Backup remains offline.

Key points

ConnectWise said the incident led to unauthorized access to application identities associated with Cloud Backup.
Mitigations began October 17 and included strengthening administrative-access protections, resetting accounts, and replacing application credentials.
ConnectWise said Cloud Backup remains offline and that SaaS Security and Cloud Management were precautionarily suspended.
Huntress reported post-compromise activity in a second tenant, similar to its earlier findings: an application granted itself Global Administrator and added secrets to other applications for persistence.
Huntress said its review of application sign-ins across more than 10,000 tenants found activity from 144.172.64[.]128 and Microsoft-internal ranges; it said some other listed addresses were associated with password-spray and failed-login attempts, which were unlikely to be related.
Huntress said it found no signs of mailbox or file manipulation, or user or policy changes, in the two tenants it reviewed.
ConnectWise said it had not observed successful threat activity in environments it monitors, but that this does not establish whether individual customer or partner Microsoft 365 tenants were affected.

Article Details

Victim Organization: ConnectWise
Incident Type: Unauthorized access to application identities associated with Cloud Backup, followed by application permission changes and credential creation for persistence in affected tenants.
Data Types Exposed: Microsoft Graph directory data may have been read; the article does not confirm that data was accessed.
Operational Impact: Cloud Backup remained offline. ConnectWise also precautionarily suspended SaaS Security and Cloud Management. The company said it had not seen successful threat activity in the environments it monitors, while noting that individual partner or customer Microsoft 365 tenants still required review.
Claim Status: confirmed

MITRE ATT&CK

T1098.001 · Additional Cloud CredentialsIn two affected tenants reviewed by Huntress, an application added a new secret to other applications for persistence.

Vendors

ConnectWiseConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a

Products

Cloud Managementand services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.ConnectWise Cloud Backupto a security incident that led to unauthorized access to application identities associated with Cloud Backup.Microsoft 365 Apps for Enterprise"This observation does not establish whether individual partner or customer Microsoft 365 tenants have been affected," it said. "Reviewing each potentially affected tenant remains essential."Microsoft GraphWhile the access may have been used for Microsoft Graph directory reads, there are no signs the attackers weaponized it for mailbox or file manipulation, or to make user or policy changes.SaaS Securityany ConnectWise products and services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.