ConnectWise Disables Cloud Backup After Microsoft 365 Intrusion

ConnectWise disabled its Cloud Backup service after attackers used a compromised application credential to access Microsoft 365 tenants, prompting concern that the same access could have reached data across multiple organizations. Huntress reported unauthorized sign-ins in 173 partner and customer tenants, while later analysis found activity from the same attacker-controlled address in nearly 1,000 tenants, including 300 successful sign-ins. Those figures describe different stages of activity and do not establish how many tenants were ultimately accessed. Microsoft said it was tracking an active supply-chain attack involving ConnectWise Cloud Backup, formerly known as SkyKick, and assessed that the attacker likely abused permissions granted by customers. The service is used by managed service providers to back up Microsoft 365 data, and its authorized access can extend to mailboxes, files, Teams content and directory information. The attackers authenticated as the application rather than as individual users. Huntress reported that in one tenant a separate ConnectWise Teams management application assigned itself the Global Administrator role and added credentials to two other...