ConnectWise has found itself in a challenging situation as it works to recover from a significant security breach affecting its Cloud Backup service. The company temporarily shut down services after an unknown threat actor accessed sensitive credentials, compromising the Microsoft 365 environments of many of its customers. This breach has left hundreds of ConnectWise's clients vulnerable, with unauthorized access detected across multiple platforms including Exchange Online, Microsoft Teams, and SharePoint Online.
Security firm Huntress reported the first wave of attacks, noting sign-in activity from malicious infrastructure affecting nearly 1,000 tenants. Over 300 of these sign-ins were successful, highlighting the severity of the compromise. ConnectWise responded by suspending services and initiating a comprehensive investigation and remediation process. Despite efforts to secure their systems, the company has yet to determine the root cause of the breach or how the attackers acquired the credentials.
The breach allowed attackers to bypass security measures like multi-factor authentication, granting them the ability to read and write across various Microsoft 365 applications. This elevated access also enabled the attackers to maintain a foothold within compromised systems, even after the initial breach was discovered. Both ConnectWise and third-party researchers have been actively working to help affected customers identify and mitigate potential threats within their systems. They have provided indicators of compromise and recommended the disabling of affected applications.
As the investigation continues, ConnectWise has not attributed the attack to any known threat actor. The company is diligently working on restoring its services but has not specified when customers can expect full access again. The incident underscores the critical importance of securing application credentials and the potential widespread impact of such breaches on managed service providers and their clients.
