ConnectWise, which makes IT management software, switched off several of its cloud services over the weekend after Microsoft and outside security firms linked a supply chain attack to its backup product. The company said on Friday that it was looking into attempts to reach the ConnectWise Cloud Backup environment without authorization, and on Saturday it confirmed that such access had occurred, according to The Record from Recorded Future News. The shutdown covers Cloud Backup along with the SaaS Security and Cloud Management platforms.
Why it matters
ConnectWise Cloud Backup exists to copy and restore data held in Microsoft 365 and Google Workspace. To do that job it needs wide permissions across mailboxes, OneDrive, SharePoint, Teams and other stores, according to the incident response firm Huntress. Those same permissions are what made the compromise serious: anyone holding the application's credentials inherits the reach the product was granted, including in places where little evidence would be left behind.
The affected customers include managed service providers, which run IT for many other organizations. Huntress noted that when an attacker gains a foothold at an MSP, the damage can spread from one customer to all the others that provider serves.
How the intrusion unfolded
Huntress investigators said a ConnectWise Cloud Backup credential was stolen and then used to enter customers' Microsoft 365 environments. Microsoft said in its own statement that the intruders most likely took advantage of permissions customers had already granted the application, among them a high-level right known as Directory.ReadWrite.All.
The timeline described by Huntress began with password spray attacks against four law firms on October 13 and 14. By October 15, roughly 50 systems the firm monitors showed attackers using ConnectWise Cloud Management applications to give themselves directory or administrative roles. In all, Huntress recorded unauthorized sign-ins across 162 tenants.
A second, more targeted round of attacks followed, aimed largely at organizations in the policy, national security, trade and critical minerals sectors. Huntress said most of those attempts failed. Many of the targeted tenants did not use any ConnectWise products, and where the relevant ConnectWise service principal was absent, the application simply was not there to be exploited.
Microsoft and other security companies also reported seeing wide-ranging attacks that began on October 15, The Record from Recorded Future News reported.
Huntress laid out why a backup tool's access is worth worrying about. Such services normally hold read rights to mail, files, Teams and directory data so they can duplicate and restore it. The bigger danger, the firm said, comes when that access is used to obtain more. An application able to assign directory roles can, as happened in one tenant, make itself a Global Administrator. From there an administrator can attach credentials to other applications, register new applications and grant them permissions, reset users' passwords and authentication methods, and alter Conditional Access policies.
Each of those steps, Huntress said, hands the attacker another route back in that does not rely on the original vendor credential. That is why replacing the vendor credential was necessary but not sufficient.
What ConnectWise has done
In a series of updates across Saturday and Sunday, ConnectWise said it had revoked the certificates used for affected application connections for every user. That cut off its own access through those connections, and it said all shared credentials previously used for Cloud Backup are now invalid and unusable.
A company spokesperson told The Record from Recorded Future News that compromised credentials and identities had been remediated, and that authentication monitoring, permission review and forensic analysis were continuing. The spokesperson said there is no indication that backup data was compromised. ConnectWise did not answer questions about the attackers or about how many customers were affected.
The company also said it cannot see inside partner and customer environments, so it is unable to say whether any particular customer's Microsoft 365 environment was breached. Since taking its countermeasures, it said, it has not observed any successful threat activity. No date has been given for restoring the services.
This is not ConnectWise's first security trouble. The company has worked through several incidents, including a nation-state attack last year on its remote monitoring and management software that affected some customers. Cybercriminals have also exploited flaws in its products in the past, in some cases leading to ransomware.
What to watch
Customers and partners will be looking for a restoration schedule and for guidance on whether their own tenants were touched, while Huntress's advice points to a broader question: whether the permissions granted to backup and management tools are tighter than they were before October 15.
