ConnectWise suspends Cloud Backup after unauthorized app-identity access
Original title: ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU
Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.
ConnectWise said it found unauthorized access on October 15 to application identities in Cloud Backup, formerly SkyKick, and interrupted that service plus integrated SaaS Security and Cloud Management. As of 16:00 UTC on October 18, backups, archive access, and restores remained unavailable. ConnectWise said existing archives stayed encrypted with no evidence of unauthorized access. Huntress said a compromised Cloud Backup Microsoft 365 API secret was used to enter customer environments, including one tenant where a ConnectWise app made itself Global Administrator and added credentials.
Unconfirmed: ConnectWise has not attributed an actor and reports no evidence of archive access, while Huntress confirms credential abuse in observed tenants.
- ConnectWise published indicators tied to IP addresses and third-party app integrations.
- Integrations with Exchange, Teams, SharePoint Online, and ConnectWise products were disabled.
- Huntress cited application ID 24205314-2b89-4e07-a2a4-579e898a5640.
- Disabling abused apps does not remove credentials already added.
- ConnectWise declined threat-actor attribution while investigating.
Impact: unauthorized access to customer Microsoft 365 environments
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
| ConnectWise SaaS Security | — |
| ConnectWise Cloud Management | — |
- 1.Review credentials on all Microsoft 365 applications, not only disabled ConnectWise apps.
- 2.Check managed Microsoft 365 tenants for the published indicators and new app credentials.
- 3.Treat Cloud Backup, SaaS Security, and Cloud Management as unavailable until restored.
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
From the original article
3 min read at theregister.comSaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access. ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments.
By Simon Sharwood · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.