ConnectWise Halts Cloud Backups After Attackers Use Credentials to Access Microsoft 365

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management platforms on October 16 to investigate a security breach involving compromised application identities, as Threat Times reported on October 19. The company halted these services to address the unauthorized access detected within its infrastructure.

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials, according to Dark Reading. This finding highlights the potential for compromised application identities to be used for external access. ConnectWise maintains that the specific impact on its customers remains unconfirmed at this time.

Context and Background

The initial suspension of services was triggered by the detection of unauthorized access to application identities. ConnectWise moved to disable Cloud Backup, SaaS Security, and Cloud Management platforms to investigate the security breach. This action reflects the vendor's response to the compromised identities.

The discovery by researchers adds detail to the incident, showing that ConnectWise credentials were used to authenticate into Microsoft 365 tenants. This raises concerns for downstream managed service providers, as noted by Dark Reading. The vendor has not yet released a full timeline of the attack or confirmed specific victim counts.

Who Is Affected

ConnectWise states that customer impact remains unconfirmed, leaving many organizations uncertain about their exposure. The use of ConnectWise credentials to access Microsoft 365 tenants implies that any organization using ConnectWise’s cloud services could potentially be at risk. MSPs are particularly concerned about downstream effects on their own clients.

Researchers warn that the ability to authenticate into Microsoft 365 using these credentials could allow attackers to access sensitive data. This raises concerns about the integrity of backups and security configurations managed through ConnectWise’s platforms. The vendor is continuing its investigation to determine the full extent of the breach.

What should you do?

Organizations should monitor their Microsoft 365 sign-in logs for unusual authentication activity, especially from ConnectWise-related service accounts. MSPs should review the permissions granted to ConnectWise applications within their tenants. Vendors are expected to provide further updates as the investigation progresses.

What to do and how to stay safe: ConnectWise

• Review Microsoft 365 sign-in logs for authentication events originating from ConnectWise service accounts or application identities.
• Audit the permissions granted to ConnectWise applications within your Microsoft 365 tenant to ensure they follow the principle of least privilege.
• Monitor for any unexpected changes to backup configurations or security settings in ConnectWise-managed environments.
• Once the vendor provides an update, apply any recommended remediation steps or patches immediately to reduce exposure.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did ConnectWise confirm that customer data was stolen?

ConnectWise states that customer impact remains unconfirmed, so it is not yet known if data was exfiltrated.

How did the attackers access Microsoft 365?

Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials.

Which ConnectWise services were suspended?

ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management platforms on October 16.