ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Original title: ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
ConnectWise suspended Cloud Backup and the integrated SaaS Security and Cloud Management services after a compromised credential for the backup app, formerly SkyKick, let attackers sign into customer Microsoft 365 tenants. Huntress reported automated sign-ins across many tenants and, in one case, new long-lived credentials on other apps. On October 17 ConnectWise disabled seven application identities and published an MSP remediation guide. Each organization must remove roles and credentials already created in its tenant.
Unconfirmed: Huntress has not linked the hosting-provider sign-ins to separate activity from Microsoft’s cloud network, and ConnectWise has not confirmed whether its own automation granted administrator roles.
- Huntress confirmed unauthorized access to at least 162 Microsoft 365 tenants.
- October 15 sign-ins used 144.172.64.128 between 06:13 and 08:34 UTC.
- Huntress saw nearly 1,000 attempts from that address and more than 300 successes.
- In one tenant, credentials added to other apps were set valid until 2028.
- Tokens issued before the October 17 shutdown may remain usable until they expire.
Impact: Sign-in as the backup app across customer Microsoft 365 tenants
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Use ConnectWise’s guide to review apps, sign-ins, credentials and administrator roles.
- 2.Remove attacker-created credentials, roles and mailbox changes in each tenant.
- 3.Treat access tokens issued before the shutdown as usable until they expire.
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
From the original article
5 min read at helpnetsecurity.com
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.