ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after compromise of app identities; Huntress sees M365 tenant takeover
ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end users cannot back up, access or restore data. Huntress says a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup was compromised and is being used to access customers' M365 environments. ConnectWise has not discussed attribution and says existing archives remain encrypted, isolated and show no evidence of unauthorized access.
Technical Details
- Huntress observed, in one partner tenant, the ConnectWise application Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640) grant itself Global Administrator. It then added new credentials to two other applications in that tenant, one of them a single-tenant Huntress application.
- Disabling the abused M365 apps does not remove credentials that were already added.
- ConnectWise published IOCs tied to a handful of IP addresses and third-party app integrations; the article does not list them. It also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online and its own products.
- The downstream exposure is hard to scope because ConnectWise does not know which M365 tenants its MSP partners manage, and end-user organizations may not know an MSP uses ConnectWise.
Remediation
- Review the credentials on all M365 applications, not just the ConnectWise ones, and remove any unrecognized ones.
- MSPs should check the M365 environments they manage for signs of compromise, using the IOCs published by ConnectWise.
- Disabling the ConnectWise apps alone is not sufficient.
Linha do tempo
-
ConnectWise suspends Cloud Backup, SaaS Security and Cloud Management after compromise of app identities; Huntress sees M365 tenant takeover
ler a análise desta fonte ocultar
ConnectWise disclosed on October 16 that on October 15 it detected unauthorized access to application identities in its Cloud Backup (formerly SkyKick) environment. It suspended Cloud Backup, plus the integrated SaaS Security and Cloud Management services, as a precaution. As of 16:00 UTC on October 18 the services were still down, so end users cannot back up, access or restore data. Huntress says a Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup was compromised and is being used to access customers' M365 environments. ConnectWise has not discussed attribution and says existing archives remain encrypted, isolated and show no evidence of unauthorized access.
Technical Details
- Huntress observed, in one partner tenant, the ConnectWise application Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640) grant itself Global Administrator. It then added new credentials to two other applications in that tenant, one of them a single-tenant Huntress application.
- Disabling the abused M365 apps does not remove credentials that were already added.
- ConnectWise published IOCs tied to a handful of IP addresses and third-party app integrations; the article does not list them. It also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online and its own products.
- The downstream exposure is hard to scope because ConnectWise does not know which M365 tenants its MSP partners manage, and end-user organizations may not know an MSP uses ConnectWise.
Remediation
- Review the credentials on all M365 applications, not just the ConnectWise ones, and remove any unrecognized ones.
- MSPs should check the M365 environments they manage for signs of compromise, using the IOCs published by ConnectWise.
- Disabling the ConnectWise apps alone is not sufficient.