ConnectWise disables Cloud Backup after Microsoft 365 logins
Original title: ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say ConnectWise credentials signed into customer Microsoft 365 tenants; downstream impact is unconfirmed.
ConnectWise said it found unauthorized access on October 14 to application identities for ConnectWise Cloud Backup, formerly SkyKick. It disabled Cloud Backup on October 17 and later disabled SaaS Security and Cloud Management while an incident-response firm investigates. Security firms say a threat actor used those credentials to authenticate into Microsoft 365 tenants. ConnectWise has not confirmed exploitation of a vulnerability or customer impact.
Unconfirmed: ConnectWise has not confirmed customer impact or that a vulnerability was exploited.
- Backups, restores, SaaS Security monitoring and Cloud Management are unavailable.
- The product can reach Exchange, OneDrive, SharePoint and Teams.
- ConnectWise primarily serves managed service providers.
- The original way the credentials were exposed remains unclear.
Impact: Possible access to customer Microsoft 365 data
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- ATT&CK
- T1078.004 Cloud Accounts
- Vendors
- ConnectWiseMicrosoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 144.172.64.128 | ty from the IP address linked to the unauthorized activity (144.172.64[.]128), and "over 300 of those succeeded." Semon tells Dark Re |
| md5 | 2256c5c673f91b16786cef00200fba55 | tion-to-boost-security#recipe=similar-items&sourcecontentid=2256c5c673f91b16786cef00200fba55) Oracle Red Bull Racing Team Revs Up Automation to Boost S |
| md5 | 2aea541e63554cbe258ee1e0e1922cb9 | s-top-ransomware-cause#recipe=similar-items&sourcecontentid=2aea541e63554cbe258ee1e0e1922cb9) Identity Attacks Overtake Exploits as Top Ransomware Caus |
| md5 | 6ad55f47190ff1c1e722feb98d8472e4 | ys-password-bad-habits#recipe=similar-items&sourcecontentid=6ad55f47190ff1c1e722feb98d8472e4) Orgs Move to SSO, Passkeys to Solve Bad Password Habits b |
| md5 | 7cc1a54dc19282ff6ce264af0924dc28 | y-guardrails-ai-agents#recipe=similar-items&sourcecontentid=7cc1a54dc19282ff6ce264af0924dc28) Microsoft Proposes Better Identity, Guardrails for AI Age |
From the original article
9 min read at darkreading.com.jpg%3Fwidth%3D720%26quality%3D80%26disable%3Dupscale&w=1280&q=75)
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.