Threat intel
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise said it has disabled seven of its application identities and suspended its Cloud Backup service after unknown threat actors gained unauthorized access to the identities and compromised Microsoft 365 tenants, according to The Hacker News.
ConnectWise said on Saturday that it has disabled seven of its application identities as it investigates an incident in which unknown threat actors obtained unauthorized access to those identities and compromised Microsoft 365 tenants, according to The Hacker News.
As part of its response, the company suspended its ConnectWise Cloud Backup service. Among the disabled identities is one named ConnectWise Cloud Backup, listed with the application identifier 506e08f9-6e9a-4da4-942b-a099a03644ae.
The identity of the attackers remains unknown. ConnectWise has not publicly detailed how the application identities were compromised, how many Microsoft 365 tenants were affected, or whether customer data was accessed. The company's investigation is ongoing.
Application identities are commonly used by third-party software vendors to integrate with customers' Microsoft 365 environments. Because these identities can hold broad permissions across a tenant, their compromise can give attackers significant access to email, files and other cloud resources without needing to steal individual user credentials. Security teams typically respond to such incidents by disabling the affected identities, revoking their tokens and reviewing audit logs for signs of unauthorized activity.
ConnectWise is a provider of IT management and remote support software widely used by managed service providers (MSPs), a position that has made its products attractive to attackers seeking downstream access to MSP clients. The Hacker News reported that the company continues to investigate the incident and has taken the affected identities offline while that work proceeds.
Source: The Hacker News
