IT‑management software vendor ConnectWise announced the suspension of its Cloud Backup service, along with SaaS Security and Cloud Management platforms, after a supply‑chain attack was identified that leveraged compromised credentials to infiltrate customers’ Microsoft 365 environments. The company first disclosed the investigation on a Friday, describing “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed the breach the following day.
Attack vector and scope
Cyber‑security firm Huntress, which responded to the incident, reported that a credential belonging to the ConnectWise Cloud Backup application was stolen and subsequently used to gain access to Microsoft 365 data. Microsoft’s own statement echoed this assessment, noting that threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.” The Cloud Backup tool requires broad access to mailboxes, OneDrive, SharePoint, Teams and other data in order to perform its backup and recovery functions, meaning that a compromised credential provides extensive visibility across an organization’s cloud resources.
Huntress detailed the timeline of the malicious activity. Initial password‑spray attacks were observed against four law firms on October 13 and 14. By October 15, attackers were using ConnectWise’s Cloud Management applications to assign themselves directory or administrative roles in roughly 50 monitored systems. In total, the firm logged unauthorized sign‑ins across 162 Microsoft 365 tenants. A second wave of attacks targeted entities in the policy, national security, trade and critical mineral sectors; however, most of those attempts failed because the targeted tenants did not have the relevant ConnectWise service principal installed.
ConnectWise’s response
ConnectWise has not disclosed the number of affected customers and declined to comment on the identity of the attackers. A company spokesperson told Recorded Future News that there is “no indication” that backup data itself was compromised. The firm emphasized that it has “remediated identified compromised credentials and identities, and we continue authentication monitoring, permission review, and forensic analysis.”
In a series of updates issued on Saturday and Sunday, ConnectWise said it revoked the certificates used for the affected application connections across all users. This action removed the compromised application’s access and rendered any previously shared credentials for Cloud Backup invalid. The company added that it lacks visibility into partner and customer environments, preventing it from determining whether a specific Microsoft 365 tenant was breached. Since implementing these remediation steps, ConnectWise reported no further successful threat activity, but offered no timeline for restoring the suspended services.
Potential impact and broader risks
Huntress warned that backup services such as ConnectWise Cloud Backup inherently possess read access to mail, files, Teams conversations and directory data in order to copy and restore information. When attackers obtain those credentials, they can elevate their privileges beyond simple data exfiltration. The firm illustrated that an application capable of assigning directory roles can promote itself to a Global Administrator, enabling the creation of new applications, granting additional permissions, resetting passwords, and altering Conditional Access policies. Each of these steps provides a new foothold that does not rely on the original compromised vendor credential, underscoring why rotating the vendor credential alone is insufficient.
The risk is amplified for managed‑service providers (MSPs), where a single compromised client can serve as a launch point to access other customers managed by the same provider. Huntress noted that attackers could leverage their foothold in one tenant to move laterally across multiple environments under the same MSP umbrella.
Historical context
ConnectWise is not new to security incidents. The company experienced a nation‑state attack on its remote management and monitoring software last year, which impacted a subset of its customers. In addition, cyber‑criminals have previously exploited multiple vulnerabilities in ConnectWise products to facilitate ransomware attacks. Those prior events provide a backdrop for the current supply‑chain breach, highlighting ongoing challenges in securing complex, integrated cloud services.
While ConnectWise has taken steps to invalidate compromised credentials and monitor for further abuse, the full extent of the breach remains unclear. The company’s inability to see into customer environments means that organizations must conduct their own investigations to confirm whether their Microsoft 365 data was accessed. As the suspension continues, affected users are left without the backup and recovery capabilities that ConnectWise Cloud Backup provides, potentially prompting them to seek alternative solutions until the service is restored.
Be First to Comment