ConnectWise takes cloud services offline after Microsoft 365 access
Original title: ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants
Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.
ConnectWise suspended Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management after finding unauthorized access to application identities in its Cloud Backup environment. An attacker holding those app credentials could obtain tokens with the backup service’s permissions and reach customer Microsoft 365 mail, files, Teams and directory data without a user MFA prompt. Huntress said that in at least one observed tenant the attacker assigned themselves Global Administrator and tried to change other application permissions. ConnectWise says it has not confirmed compromise of partner backup data and has not named an actor.
Unconfirmed: ConnectWise has not confirmed that partner backup data was compromised and has declined to attribute the access.
- Suspicious activity investigation began on October 15; access was identified by October 17.
- ConnectWise’s October 19 update gives no confirmed restoration time.
- Huntress saw a Global Administrator role added in one customer tenant.
- Customers were told to keep affected application connections disabled and preserve sign-in and audit logs.
Impact: Potential access to customer Microsoft 365 mail, files and directory data
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
| ConnectWise SaaS Security | — |
| ConnectWise Cloud Management | — |
- 1.Keep affected ConnectWise application connections disabled until restoration instructions.
- 2.Preserve sign-in and audit logs and review roles, consent grants and federation trusts.
- 3.Check for unauthorized mailbox forwarding, inbox rules and other changed identities.
- Vendors
- ConnectWiseMicrosoft
- Victims
- ConnectWise
- Organizations
- HuntressSpecterOps
From the original article
3 min read at infosecurity-magazine.com
Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown attackers have full access to client environments via stolen tokens
By Danny Palmer · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.