ConnectWise suspends cloud services after M365 tenant access
Original title: ConnectWise Suspends Cloud Services in Response to Cyberattack
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
ConnectWise suspended Cloud Backup on October 17 after unauthorized access to application identities, then shut down SaaS Security and Cloud Management the next day. Huntress says a compromised Cloud Backup credential signed into customer Microsoft 365 tenants and that, in one tenant, Cloud Management for Teams added itself to Global Administrator and created new client secrets. ConnectWise says backups stay encrypted and it has no evidence they were accessed; restoration timing is not given. Huntress has not linked an earlier password-spray phase to the same operator.
Unconfirmed: Huntress says it has not tied the October 13–14 password spraying to the same operator as the later tenant access.
- Cloud Backup was suspended about 12 hours after the investigation began on October 17.
- By October 17 Huntress saw the attacker IP in nearly 1,000 Entra tenants, with over 300 successful sign-ins.
- Graph tokens were obtained from 144.172.64.128 on October 15 between 06:13 and 08:34 UTC.
- Tenants without the relevant ConnectWise service principal were not entered despite a successful sign-in.
- Exchange Online, Teams, and SharePoint Online ConnectWise apps were also abused, Huntress says, and have been shut down.
Impact: Unauthorized access to customer Microsoft 365 application identities
- 1.Review MSP Microsoft 365 environments using ConnectWise’s published guidance and shared intrusion IP addresses.
- 2.Check tenants for configuration changes or persistence left by the ConnectWise apps.
From the original article
3 min read at securityweek.com
The services remain unavailable as the company continues remediation and security validation. The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.