Hackers used ConnectWise backup app credential to break into Microsoft 365 systems
Hackers used a compromised credential for a ConnectWise backup service to get into more than 160 groups' Microsoft 365 systems, security firm Huntress said. That access could let them read mail and files. ConnectWise shut off the app's access and said it had seen no sign that stored backups were hit.
Hackers used a compromised credential belonging to ConnectWise's Cloud Backup service, formerly SkyKick, to sign in to customers' Microsoft 365 systems, BleepingComputer and The Hacker News reported, citing security firms and Microsoft.
The backup app has broad permissions in each customer's Microsoft 365 environment so it can copy mail and files. Signing in as the app gave the attacker the same access, including the ability to read and write mail, OneDrive and SharePoint files, and Teams chats, security firm Todyl said, according to BleepingComputer and The Hacker News. Because no user logged in, protections such as multifactor authentication did not apply, BleepingComputer reported.
Security firm Huntress said it had confirmed unauthorized sign-ins in 162 customer environments as of 3 p.m. ET Friday, and BleepingComputer reported that count. The sign-ins came on October 15 from a single internet address, the outlets reported. In a later update, Huntress said nearly 1,000 Microsoft 365 environments had sign-in activity from that address and more than 300 of those sign-ins succeeded, though not all led to access.
Microsoft called it an active supply chain attack and said the attacker also tried to add new credentials to keep access, the outlets reported.
In at least one environment, a second ConnectWise app gave itself global administrator rights and added credentials to two other trusted apps, including one belonging to Huntress, BleepingComputer and The Hacker News reported. Huntress said in an update that the same address made a second, unsuccessful wave of attempts on October 15 against 16 of its customers in policy, national security, trade and critical minerals.
ConnectWise said it found unauthorized access to app identities in its Cloud Backup environment and shut off the service's app access. "We have no indicators to date that Cloud Backup partner backup data has been compromised," ConnectWise said, BleepingComputer reported.
ConnectWise and Microsoft urged administrators to review sign-ins and credential changes tied to the backup app, BleepingComputer reported. Huntress said in its advisory that customers should disable the affected apps rather than delete them.
What we know: Attackers used a ConnectWise backup credential to sign in to more than 160 Microsoft 365 customer environments.
What we don't: Who is behind the attack and how much data was taken.
Where outlets agree BleepingComputer and The Hacker News report that attackers used ConnectWise Cloud Backup's Microsoft 365 credential to sign in to customer environments on October 15 and that ConnectWise shut off the app's access.
Where they differ The outlets cited here report the same key facts so far.