Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
ConnectWise shut down Cloud Backup after attackers accessed application identities and signed into customer Microsoft 365 tenants. Huntress reported at least 162 compromised tenants; Microsoft confirmed unauthorized authentication from 144.172.64.128 on October 15 and called it an active supply-chain attack. The attacker used the backup app’s existing secret and Entra permissions, bypassing MFA, with access to mail, OneDrive, SharePoint, and Teams. In some tenants, service principals assigned themselves Exchange or Global Administrator roles and added credentials; ConnectWise said backup archives show no compromise indicators.
- ConnectWise disabled Cloud Backup after unauthorized access to application identities.
- Huntress identified at least 162 compromised Microsoft 365 tenants.
- Attackers signed in as the backup app with its secret, bypassing MFA.
- Some service principals self-assigned Exchange or Global Administrator and added credentials.
- Activity was traced to 144.172.64.128 beginning October 15.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078.004 Cloud AccountsT1098.003 Additional Cloud RolesT1098.001 Additional Cloud CredentialsT1526 Cloud Service Discovery
- Vendors
- ConnectWiseMicrosoft
- Organizations
- ConnectWiseMicrosoftHuntressTodyl
From the original article
4 min read at bleepingcomputer.com
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]
By Ionut Ilascu · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.