ConnectWise has suspended access to its Cloud Backup service following a security breach involving unauthorized access to application identities that compromised Microsoft 365 tenants. The attack began around October 15 from a single IP address, with Huntress identifying at least 162 compromised tenants. Microsoft confirmed the malicious activity on the same date. The attacker used the backup service’s existing permissions to access customer data, including emails, files, and Teams chats. Since the attack involved automated scripts rather than user logins, security measures like multi-factor authentication proved ineffective.
Multiple cybersecurity firms documented the breach’s scope and methods. Todyl researchers found that attackers directly authenticated to Microsoft 365 using the backup application’s credentials, while Huntress observed persistence attempts on nearly 50 monitored tenants where attackers assigned themselves administrative roles. Microsoft characterized the incident as an active supply-chain attack. ConnectWise stated that stored backup data had not been compromised and would remain accessible once services resume, though the company provided no timeline for restoration. Administrators have been advised to review application credentials, sign-in activities, and remove unauthorized additions since October 13.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
