ConnectWise resets Cloud Backup credentials after unauthorized access
Original title: ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
ConnectWise said unauthorized access reached application identities tied to Cloud Backup. Since October 17 it disabled affected connections, suspended Cloud Backup plus SaaS Security and Cloud Management, reset accounts and application credentials, and hired outside responders. It reports no impact to other products and no successful threat activity in environments it monitors. Partners must still review Microsoft 365 tenants; Huntress described persistence through new application secrets without mailbox or file changes.
Unconfirmed: ConnectWise says monitored environments show no successful threat activity, but individual tenant impact is not established.
- Mitigations began October 17 at 5:00 a.m. UTC, three days after identification.
- Huntress reviewed application sign-ins across more than 10,000 tenants.
- Only 144.172.64.128 and Microsoft-internal ranges produced application sign-ins.
- Password-spray addresses in the same provider range were judged unrelated.
Impact: unauthorized access to Cloud Backup application identities
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Do not reconnect affected applications until ConnectWise gives formal restoration instructions.
- 2.Preserve evidence and review each potentially affected Microsoft 365 tenant.
- 3.Look for sign-ins from 144.172.64.128 and unexpected Global Administrator or app-secret changes.
- Vendors
- ConnectWise
- Organizations
- Huntress
From the original article
3 min read at thehackernews.com
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.