ConnectWise said it suspended access to its Cloud Backup service after a suspected supply chain attack targeting Microsoft 365 users was uncovered in an attack that was first detected on Wednesday.
ConnectWise said services for SaaS Security and Cloud Management were also suspended, as those services are connected to Cloud Backup, formerly known as SkyKick.
There is no evidence that Cloud Backup partner backup data has been compromised, a ConnectWise spokesperson told Cybersecurity Dive.
ConnectWise Cloud Backup is a backup and recovery service used across various managed service providers to manage their Microsoft 365 and Google Workspace data, according to Huntress. The service therefore has access to OneDrive, SharePoint, Teams and directory data.
Microsoft Threat Intelligence on Saturday confirmed it was tracking an active supply-chain attack involving the compromise of a trusted OAuth App for ConnectWise Cloud Backup, according to a post on X.
ConnectWise Cloud Backup is a multitenant vendor application, Microsoft said, noting that customers grant permission for the application to operate in their respective tenants. Microsoft researchers assess that the hacker “likely abused permissions previously granted by customers” to the application.
Microsoft said it detected “broad successful principal authentication” on Thursday from an IP address 142.172.64[.]128. It also picked up Microsoft Graph API reconnaissance and attempts from the threat actor to add additional credentials in order to maintain access as a backdoor, according to the post.
Huntress, a Maryland-based managed security platform, said a compromised user credential for ConnectWise Cloud Backup was used to gain unauthorized access to Microsoft 365 users, according to a blog post released Friday. Huntress said it confirmed unauthorized sign-ups in 162 customer tenants.
“A Huntress partner tipped us off to suspicious activity from the ConnectWise application,” Jon Semon, principal security operations analyst at Huntress, told Cybersecurity Dive. “We opened an investigation, and it turned into a rapid response involving multiple teams across Huntress.”
From a separate hosting address, the unidentified hackers attempted to sign into more than 1,000 Microsoft 365 customer accounts that were protected by Huntress, according to Semon. The hackers successfully gained access to more than 300 of them.
Todyl, a cybersecurity platform for managed service providers, confirmed impacts from the same attack. The company said that an attacker used a valid credential to sign in to Microsoft 365 tenants, according to a blog post released Friday.
ConnectWise provided recommendations for security teams to take:
- Preserve available sign-in and audit records, while taking urgent action to contain.
- Review application and user authentication, application credentials and federation trusts.
- Check for unauthorized mailbox forwarding, inbox rules or delegated mailbox access.
- Investigate any other identities changed or used during suspicious activity.
