ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Original title: ConnectWise customers hit by supply-chain attack linked to compromised API secret
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management after an unidentified threat actor used a sensitive multi-tenant API secret, formerly tied to SkyKick, to sign in to customers’ Microsoft 365 apps. Huntress confirmed unauthorized sign-ins in 162 tenants and said compromises beyond its telemetry are likely. The secret let an automated tool read and write mail and files, bypass multi-factor authentication, and add credentials. Restoration has no timeline, and the root cause remains under investigation.
Unconfirmed: How the API secret was obtained is unconfirmed, and no threat group has been identified.
- Microsoft reported broad successful sign-ins from a malicious IP on October 15.
- Follow-on activity tried to add credentials on related service principals.
- ConnectWise says monitored environments showed no successful activity after October 17 at 05:00 UTC.
- Customers were urged to disable affected applications even without unusual logs.
Impact: Read and write access to Microsoft 365 mail and files
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Review Microsoft 365 tenants for the published indicators of compromise.
- 2.Disable affected ConnectWise applications even if logs look normal.
- 3.Check service principals for credentials added after the sign-ins.
- ATT&CK
- T1199 Trusted RelationshipT1078 Valid AccountsT1550.001 Application Access TokenT1098 Account Manipulation
- Vendors
- ConnectWiseMicrosoft
From the original article
4 min read at cyberscoop.com
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. The post ConnectWise customers hit by supply-chain attack linked to compromised API secret appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.