Thought Leadership
Attackers used stolen ConnectWise application credentials to access around 300 Microsoft 365 tenants. Cloud Backup has been suspended.
IT management software provider ConnectWise has disabled seven of its application identities in Microsoft Entra ID and suspended its Cloud Backup service. Unknown attackers gained unauthorized access to the application identities and used them to compromise customers’ Microsoft 365 environments. The affected app registrations cover ConnectWise Cloud Backup and Cloud Management, with access to Microsoft Teams, Exchange Online, Microsoft Graph, Partner Center, and SharePoint Online. ConnectWise has also revoked the certificates associated with the affected connections for all users.
“Disabling the affected connections prevents new sign-ins through those connections, but it does not reverse changes previously made within a tenant.”
ConnectWise
Previously issued access tokens may remain usable until they expire.
Backups and Recovery Unavailable
Scheduled backups are currently not running, and access to archives and recovery operations is unavailable. According to ConnectWise, existing archives remain encrypted, isolated, and intact. The company said it has found no evidence that the attackers accessed them. As a precaution, ConnectWise has also shut down its SaaS Security and Cloud Management services. The company detected the incident on October 14. It remains unclear how the application credentials were exposed and whether a product vulnerability played a role.
Microsoft 365 Access Without Customer Passwords
Using the stolen credentials, the attackers could authenticate as the respective applications and request access tokens from Microsoft Entra ID with the applications’ existing permissions. This allowed them to access customer environments without stealing individual customers’ passwords. Depending on the permissions granted, the attackers could retrieve mailbox contents, SharePoint documents, Teams messages, and directory data. They could also assign the Global Administrator role to an application, add their own client secrets to other applications within a tenant, or create new applications. These secrets can provide continued access even after the original credentials have been revoked.
According to security firm Huntress, the IP address involved in the incident generated sign-in activity across nearly 1,000 Entra tenants, with around 300 successful logins. Huntress confirmed misuse of the Teams application in one tenant. On October 15, Huntress also observed a second, targeted wave of attacks against 16 tenants in the political, national security, trade, and critical raw materials sectors. That attempt was unsuccessful. Huntress has reported no further activity since then.
Review All Microsoft 365 Tenants
ConnectWise and Huntress recommend that partners review their own Microsoft 365 tenants and all customer tenants they manage, including those with dormant connections to SkyKick.
Sign-in activity dating back to October 13 should be checked for activity originating from the following IP addresses:
- 144.172.64[.]128
- 144.172.64[.]99
- 144.172.64[.]60
Logs should be preserved before taking remediation steps. Administrators should review application credentials, directory roles, consent grants, mailbox forwarding settings and rules, as well as delegated mailbox access. Policies governing application management in Entra can help restrict the use of client secrets and limit their validity periods.
(Editorial Team)
