Compromised ConnectWise API Secret Used to Access Customer Microsoft 365 Tenants
Summary
Attackers used a ConnectWise Cloud Backup API secret to access customer Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants; ConnectWise suspended services and advised customers to disable affected applications while investigation and recovery
Key points
- A threat actor obtained a sensitive API secret used to connect ConnectWise Cloud Backup with customers’ Microsoft 365 environments.
- Huntress observed sign-in activity across nearly 1,000 Entra tenants, with more than 300 sign-ins appearing successful; it confirmed unauthorized sign-ins in 162 tenants.
- Affected Microsoft services included Exchange Online, Teams, SharePoint Online, Cloud Backup, Microsoft Graph and Partner Center.
- Microsoft said follow-on activity included Microsoft Graph reconnaissance and attempts to add credentials to service principals, potentially preserving access.
- ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management services; restoration was underway with no confirmed timeline for customer access.
- ConnectWise said it had not observed successful threat activity in monitored environments since mitigations began, but individual customer tenants still required review.
- ConnectWise and researchers shared indicators of compromise and urged potentially affected customers to disable affected applications, even if logs showed no unusual activity.
Article Details
- Victim Organization
- ConnectWise
- Incident Type
- Supply-chain attack involving a compromised ConnectWise Cloud Backup API secret and unauthorized access to customer Microsoft 365 tenants.
- Data Types Exposed
- Email and files were accessible to the attacker; the source does not confirm that they were read or exfiltrated.
- Affected Records
- Huntress confirmed unauthorized sign-ins in 162 tenants and reported more than 300 apparently successful sign-ins across almost 1,000 Entra tenants. The number of affected customer records is not disclosed.
- Operational Impact
- ConnectWise temporarily suspended Cloud Backup, SaaS Security, and Cloud Management. Some customers could not access the service for days, and restoration was still underway without a confirmed timeline.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
People
Vendors
ConnectWiseA portion of ConnectWise’s customers have been adrift for days, and hundreds are compromised, as the company’s efforts to restore its Cloud Backup service remain underway with no confirmed timeline for when customersHuntressOnline, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.Microsoftto a highly sensitive credential that allowed its customers to connect the vendor’s application with Microsoft 365 environments.TodylResearchers at Huntress and Todyl, which conducted its own investigation, characterized the secret and its chain of command as critical.
Products
Cloud ManagementConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services about two days after researchers observed an initial wave of unauthorized sign-ins.ConnectWise Cloud Backupidentified, used the application programming interface (API) secret to compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePointEntralate Saturday Huntress “had seen sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 of those sign-ins appearing to succeed,” Jonathan Semon, principal securityExchange Onlineto compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.Microsoft 365 Apps for Enterpriseto a highly sensitive credential that allowed its customers to connect the vendor’s application with Microsoft 365 environments.Microsoft GraphMicrosoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.Microsoft Partner Centerincluding Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.Microsoft Teamsseries of ConnectWise Cloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.SaaS SecurityConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services about two days after researchers observed an initial wave of unauthorized sign-ins.SharePoint OnlineCloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.