ConnectWise Suspends Cloud Backup and Management Services After App Credential Theft
The IT service management vendor took services offline after attackers stole seven application identities to access Microsoft 365 data.
Key points
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to seven application identities.
- Attackers used stolen credentials to bypass password requirements and access Microsoft 365 tenants, including mailboxes and SharePoint documents.
- The company revoked affected certificates on October 17 and engaged a third-party firm to investigate the breach and monitor for further activity.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services over the weekend after discovering that attackers had stolen credentials for seven of its application identities. The company took these actions to protect customer Microsoft 365 environments from unauthorized data access, according to Security Affairs.
The vendor detected the incident on October 14 through internal monitoring systems. ConnectWise disabled the compromised identities on October 17 and published an alert detailing the protective measures taken. The company stated that it has not observed successful threat activity since implementing these mitigations, but the investigation remains ongoing.
How the Attack Worked
The breach did not involve attackers stealing individual customer passwords. Instead, the malicious actors obtained the application credentials that ConnectWise uses to manage services and run backups for clients. These applications already had permission to access customer Microsoft 365 environments. By stealing these specific credentials, the attackers could impersonate ConnectWise’s own applications.
According to Security Affairs, the attackers used the stolen identities to request access tokens from Microsoft Entra ID. This method allowed them to bypass standard password protections. The shared credentials previously used for Cloud Backup are no longer valid, as ConnectWise revoked the certificates associated with the affected application connections across all users.
Scope and Impact
Depending on the permissions granted to the compromised applications, the attackers could access sensitive data within Microsoft 365 tenants. Security Affairs reported that this included mailboxes, SharePoint documents, Teams messages, and directory data. ConnectWise noted in its October 17 alert that it has no indication that any other product, service, or offering is impacted at this time.
The company mobilized its internal security teams and Security Operations Center to handle the incident. Additionally, ConnectWise engaged a reputable third-party incident response firm to support the investigation and containment efforts. These teams are actively monitoring the backup infrastructure and the broader environment, with the investigation extending across all partner-facing services.
What should you do?
Security professionals should review their Microsoft 365 access logs for any unusual activity originating from ConnectWise application identities. Organizations should verify that they have revoked any unnecessary permissions for third-party management tools. Monitoring for new access tokens generated by these identities is also critical.
What to do and how to stay safe: ConnectWise
- Review Microsoft 365 sign-in logs for activities associated with ConnectWise application identities, particularly those occurring around October 14.
- Audit permissions granted to third-party backup and management applications to ensure they follow the principle of least privilege.
- Monitor for any new access tokens or session initiations from the compromised application identities mentioned in ConnectWise’s alert.
- Check for any unauthorized changes to directory data, mailbox access rules, or SharePoint permissions that may have occurred during the breach window.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did attackers steal user passwords in this ConnectWise breach?
No, the attackers stole application credentials, not individual customer passwords, allowing them to bypass password requirements by impersonating the service.
Which ConnectWise services were suspended due to this incident?
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after discovering the unauthorized access to application identities.
What data could the attackers access through the stolen credentials?
Attackers could access mailboxes, SharePoint documents, Teams messages, and directory data within affected Microsoft 365 tenants.
