ConnectWise suspends Cloud Backup after supply-chain credential attack
Original title: ConnectWise suspends Cloud Backup service after supply chain attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
ConnectWise shut down Cloud Backup, SaaS Security, and Cloud Management after confirming unauthorized access to its cloud backup environment. Huntress and Microsoft said a compromised ConnectWise Cloud Backup credential was used against customer Microsoft 365 tenants, including highly elevated permissions such as Directory.ReadWrite.All. ConnectWise revoked affected certificates and said shared Cloud Backup credentials are no longer valid, with no restoration timeline.
Unconfirmed: ConnectWise has not said how many customers were affected and cannot confirm which Microsoft 365 tenants were breached.
- Password-spray activity hit four law firms on October 13 and 14.
- By October 15, about 50 Huntress-monitored systems saw admin-role assignment.
- A second wave targeted policy, security, trade, and critical-mineral sectors.
- ConnectWise says there is no indication backup data was compromised.
- Huntress warned rotating the vendor credential alone is not enough.
Impact: Access to Microsoft 365 data and ability to assign admin roles
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
| ConnectWise SaaS Security | — |
| ConnectWise Cloud Management | — |
- 1.Review Microsoft 365 permissions and unexpected directory or admin roles tied to ConnectWise apps.
- 2.Treat revoked vendor credentials as insufficient; check for new apps, passwords, and Conditional Access changes.
- ATT&CK
- T1110.003 Password SprayingT1078 Valid AccountsT1098 Account ManipulationT1199 Trusted Relationship
- Vendors
- ConnectWiseMicrosoft
- Organizations
- Huntress
From the original article
3 min read at therecord.mediaConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.