ConnectWise backup credential used to enter Microsoft 365 tenants
Original title: ConnectWise backup credentials exposed multiple Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
A credential for ConnectWise Cloud Backup was compromised and used to obtain Microsoft Graph tokens in customer tenants without a user sign-in or MFA prompt. Huntress tied authentications on October 15 to hosting IP 144.172.64.128 and later noted two more addresses. ConnectWise disabled seven application identities on October 17, revoked certificates, and suspended Cloud Backup, SaaS Security and Cloud Management. It says backup archives show no sign of compromise, but restoration timing is unset and prior tokens may still work.
Unconfirmed: Huntress has not confirmed data theft or that every stage was done by the same operator.
- Huntress confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16.
- In one partner tenant, Cloud Management assigned itself Global Administrator and added app credentials.
- That sequence took about five minutes; the same operator is not established.
- ConnectWise’s October 19 update said it had not seen successful activity since containment in monitored environments.
- Huntress found no mail or file access in one detailed tenant but has not confirmed that no data was taken.
Impact: Application tokens in customer Microsoft 365 tenants, including possible admin changes
- 1.Review application sign-ins, credentials, directory roles, consent grants, policy changes and mailbox forwarding.
- 2.Keep affected ConnectWise applications disabled until formal restoration instructions.
- 3.Assume previously issued access tokens may remain usable until they expire or are invalidated.
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
From the original article
3 min read at csoonline.com
ConnectWise has disabled key cloud services and is investigating unauthorized access to customers’ Microsoft 365 environments after a credential tied to its Cloud Backup platform was compromised and used to authenticate into customer tenants, prompting Huntress to identify suspicious sign-ins across 162 organizations.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.