Unauthorized Access Through Compromised ConnectWise Credentials Impacts Microsoft 365 Users
In a concerning breach of security protocols, attackers have exploited compromised ConnectWise Cloud Backup credentials to gain unauthorized access to Microsoft 365 customer environments. This alarming incident led ConnectWise to disable application access and interrupt backup services, prioritizing the security of its users.
As of October 16—the date on which the unauthorized activity was confirmed—Jonathan Semon, a researcher, reported that sign-ins from malicious actors were detected across 162 tenant accounts. This underscores the risks posed by relying on privileged vendor applications, demonstrating a significant vulnerability within the system.
According to an update from ConnectWise on October 17, investigators were able to confirm that unauthorized access had occurred within its Cloud Backup environment. The company reassured its clients that, despite the breach, there were no indications that backup data belonging to partners had been compromised. Importantly, existing archive data remained intact and unaffected by the service disruption, alleviating some immediate concerns for users.
The service impacted by this breach, which was previously known as SkyKick, provides essential cloud backup and recovery solutions specifically designed for managed service providers (MSPs). This application holds extensive permissions that are necessary for securing Microsoft 365 components, including mailboxes, OneDrive, SharePoint, Teams, and directory information.
Semon of Huntress detailed how the attackers utilized the compromised application credentials to extract Microsoft Graph tokens from a hosting-provider address recognized as 144.172.64[.]128 during a window from 06:13 to 08:34 UTC on October 15. The rapidity at which requests were made through tenant accounts, all within a matter of seconds, suggests that the attacks were executed using automation techniques. The stolen credentials allowed the attackers to authenticate themselves as a trusted application while inheriting permissions that were pre-authorized in each tenant environment.
The implications of this breach extend beyond the immediate victims. Organizations whose applications were consented to also face potential risks. In one instance, Huntress identified that a secondary application, titled ConnectWise Cloud Management—MS Teams, was observed granting itself Global Administrator privileges and subsequently appending client secrets to other applications. This indicates a sophisticated level of tampering, as these added secrets were configured with an expiration date set for 2028, creating a risk of ongoing access independent of the originally compromised credentials.
These concerning developments emerged approximately two and a half hours before the public IP authentications occurred. At this juncture, it remains unclear whether the sequences of activities traced to the same operator. A logged private IPv6 address also muddies the waters, as it cannot definitively identify the perpetrator given that legitimate traffic may also utilize that infrastructure.
While data theft has yet to be confirmed, Huntress has cautioned that the absence of visible activity related to mailboxes or files does not guarantee safety. This is particularly true in scenarios where reads from directory services lack the necessary audit trails, leaving organizations vulnerable.
To mitigate further risks, Huntress has recommended that administrators disable, rather than delete, both the ConnectWise Cloud Backup application (identified by ID 506e08f9-6e9a-4da4-942b-a099a03644ae) and the Cloud Management—MS Teams application (ID 24205314-2b89-4e07-a2a4-579e898a5640). Furthermore, other applications associated with ConnectWise should also undergo thorough review to ensure security integrity.
Administrators are advised to scrutinize Microsoft Entra service principal sign-in logs for any signs of suspicious authentication linked to the IP address 144.172.64[.]128 and to investigate any unexpected directory-role assignments or changes to applications. It is crucial to recognize that simply disabling vendor applications will not eliminate secrets that may have been planted elsewhere in the system’s framework.
Organizations must take a proactive stance to audit client secrets and certificates across application registrations and enterprise applications. This includes the removal of any unauthorized credentials that may have been added since October 13 and the revocation of unexpected privileges granted to users.
Applications believed to be affected should remain disabled until ConnectWise confirms that credential resets have been successfully executed. While backup interruptions pose a challenging operational hurdle, ConnectWise has reassured partners that their stored backups remain secure and have not been deleted.
In summary, the incident involving compromised ConnectWise credentials serves as a wake-up call to the importance of robust cybersecurity practices, particularly for organizations that depend on vendor applications. As they navigate the fallout from this breach, entities must remain vigilant in their security audits and strategies to prevent potential future compromises.