Circuit Wire — a daily news update from the Circuit.
ConnectWise shut down its Cloud Backup service on October 17 after attackers used a compromised application credential to sign in to customers' Microsoft 365 environments, BleepingComputer reported.
The service, formerly SkyKick Cloud Backup, is used by managed service providers and their customers. Security firm Huntress confirmed unauthorized sign-ins in 162 tenants. CyberScoop reported that Huntress saw sign-in activity across almost 1,000 Entra tenants, and more than 300 of those sign-ins appeared to succeed.
The attackers did not need a user password. They used the application's own secret, so the automated sign-ins bypassed multifactor authentication. Huntress analyst Jonathan Semon told CyberScoop that "anyone holding that credential can request access tokens in any tenant where the application is installed."
Huntress traced scripted sign-in attempts to October 13 and 14. On October 15, Microsoft flagged unauthorized authentication attempts from a single IP address. ConnectWise announced the service interruption at 05:01 UTC on October 17 and disabled seven application identities.
In at least one tenant, Huntress saw the application's account give itself a Global Administrator role and add credentials. Microsoft reported attempts to add credentials to the related service principal as a backdoor. Those steps can preserve access after the original application is disabled.
ConnectWise said it has no indicators that partner backup data was compromised. It also said its monitoring cannot establish whether individual partner or customer Microsoft 365 tenants were affected.
On October 18, the company said the shared Cloud Backup credentials were no longer valid. It added that previously issued access tokens may remain usable until they expire. Its SaaS Security and Cloud Management services were also taken offline as a precaution.
Huntress warned that rotating the vendor credential is necessary but not enough. The Record noted that ConnectWise did not answer questions about who was behind the attack or how many customers were affected.
As of October 20, restoration was still underway, with no timeline for when customers will regain access. ConnectWise has not said how the attackers obtained the credential, and no group has claimed responsibility. The Record noted a prior incident at the company: a nation-state attack on its remote management software the previous year.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.