ConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers’ M365 tenants.
The company suspended the Cloud Backup service (formerly known as SkyKick) on October 17, roughly 12 hours after it started investigating the suspicious activity.
“We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment. As a protective measure for our Cloud Backup partners and their clients, we are shutting off Cloud Backup application access,” the company said.
The next day, it decided to shut down SaaS Security and Cloud Management as well, to implement mitigations, noting that customers’ backups remain encrypted and protected and that it has no evidence of unauthorized access to them.
The containment measure continues to impact scheduled backups, archive access, and restores, as well as SaaS Security monitoring and alerting, and Cloud Management user and license management, and ConnectWise has not provided an estimated restoration timeline.
However, it has shared information on the IP addresses used in the intrusion and has published guidance for reviewing MSPs’ Microsoft 365 environments.
According to cybersecurity firm Huntress, the compromised Cloud Backup credential was used to access Microsoft 365 tenants on October 15.
Cloud Backup’s identity was seen signing in to 162 Microsoft 365 tenants between October 15 and October 16.
“The authentication itself is certain: It comes from Microsoft’s own sign-in logs in each tenant. The credential type was a client assertion, which means the credential lives in the vendor’s own tenant. Nothing a customer did in their environment could have produced it,” Huntress says.
The activity originated from the same IP address that was used between October 13 and October 14 in password spraying attacks against four law firm tenants and in scripted sign-in attempts.
In one customer tenant, Huntress observed the ConnectWise Cloud Management app for Microsoft Teams adding itself to the Global Administrator role on October 15, then running a Python script that added new client secrets to an MSP management application and to Huntress’s own application.
This happened roughly two and a half hours before the first sign-ins from the attacker’s IP address, and the access came from Microsoft’s internal cloud network rather than that IP. Huntress says it has not tied the two phases to the same operator.
“The app’s credential is in hostile hands. It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list,” Huntress notes.
By October 17, the cybersecurity firm had identified sign-in activity from the attacker’s IP address in nearly 1,000 Entra tenants, with over 300 of the sign-ins being successful. However, a successful sign-in did not always mean access: in tenants lacking the relevant ConnectWise service principal, the attackers could not get in.
Huntress says it is highly confident the threat actor also abused the ConnectWise Cloud Management Exchange Online, MS Teams, and SharePoint Online applications as part of the intrusions. All three have been shut down by ConnectWise.
“ConnectWise has stopped the attack. But businesses unfortunately have the responsibility and difficult task to ensure that the threat actor didn’t change any Microsoft 365 configuration or establish any persistence within their tenant. More than a third of IT leaders wrongly believe that Microsoft automatically backs up their configuration, making recovery from such an attack all the more tricky,” CoreView VP of security strategy Kasper Lindgaard said.
Related: Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Related: Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Related: In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
