Cybersecurity researchers have identified an active attack campaign in which unknown threat actors are exploiting a compromised Microsoft 365 credential from ConnectWise Cloud Backup to gain unauthorized access to customer environments. Security firm Huntress confirmed unauthorized sign-ins across 173 partner and customer tenants using the stolen credential. Because ConnectWise Cloud Backup requires broad permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data, attackers with the compromised credential can access sensitive information across affected organizations. The attacker used a specific IP address to obtain tokens and systematically moved through tenants in a scripted manner between October 15 and early morning hours UTC.
In response, ConnectWise has suspended Cloud Backup application access pending further investigation. Security researchers recommend that organizations immediately disable the application, enable Microsoft Graph activity logging, and audit for any unauthorized credential additions or suspicious directory role assignments since October 13. Experts caution that some types of unauthorized access may leave no audit trail, making immediate action preferable to waiting for evidence of data compromise. ConnectWise stated it found no evidence that customer backup data was compromised, though the full impact depends on permissions configured in each affected tenant.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
