Skip to content
securitytabs

LiveUpdated

ConnectWise disables cloud services after attackers abuse app identities to reach Microsoft 365 tenants

Attackers used stolen credentials belonging to ConnectWise cloud services to break into customers' Microsoft 365 accounts, and ConnectWise has switched several of those services off. Companies whose IT provider uses ConnectWise should ask whether they are affected.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms that rely on an MSP using ConnectWise may be affected without knowing it. Sources report that ConnectWise cloud services were switched off and that customer Microsoft 365 tenants were compromised. [1][2][3]

What to do

  1. Ask your IT provider whether it uses ConnectWise Cloud Backup, SaaS Security or Cloud Management and whether your Microsoft 365 account was affected. [1][3]
  2. Watch for notices from ConnectWise and your provider about the investigation. [3]

Mid-size company

A small IT or security team

What to know

Sophos describes automated sign-ins using the vendor's application identity across consenting tenants, so organizations that authorized ConnectWise applications in Microsoft 365 are in scope. No fix or indicator list is cited here beyond ConnectWise disabling the identities. [4][3]

What to do

  1. Check whether your Microsoft 365 tenant has granted consent to any ConnectWise application. [4][3]
  2. Review Entra sign-in logs for the disabled ConnectWise application identities listed by ConnectWise. [3][4]
  3. Follow ConnectWise's advisories as the investigation continues. [1]

Large enterprise

A security operations team

What to know

CyberScoop reports the activity is a supply-chain attack tied to a compromised API secret, with hundreds of customers confirmed impacted, and Infosecurity Magazine says ConnectWise is examining whether attackers have full access to client environments through stolen tokens. [2][1]

What to do

  1. Inventory third-party applications with consent in your Microsoft 365 tenants, including ConnectWise ones. [4][3]
  2. Hunt in Entra and Microsoft Graph logs for sign-ins and token requests by the seven ConnectWise application identities that ConnectWise disabled. [3][4]
  3. Ask ConnectWise and any MSP in your supply chain for incident status and whether your tenant was accessed. [1]

What happened

The Hacker News reports that ConnectWise said it had disabled seven ConnectWise application identities while investigating an incident in which unknown threat actors obtained unauthorized access to those identities and compromised Microsoft 365 tenants. An application identity is the sign-in credential a software service uses to connect to a customer's Microsoft account. The disabled identities include ConnectWise Cloud Backup. [3]

Infosecurity Magazine reports that the Cloud Backup, SaaS Security and Cloud Management services were taken offline, and that ConnectWise is investigating whether the attackers could have full access to client environments through stolen tokens (digital passes that prove a sign-in). [1]

How the attack worked

Sophos News describes automated sign-ins that used the vendor's Entra application identity to request Microsoft Graph tokens across tenants that had consented to the application, a pattern it calls a cross-tenant token sweep. [4]

CyberScoop reports the supply-chain attack is linked to a compromised API secret, a sensitive credential, and says hundreds of customers are confirmed impacted. Sources reviewed do not yet name the attackers or give a final customer count. [2]

Timeline

  1. CyberScoop reported that hundreds of customers were confirmed impacted and linked the attack to a compromised API secret. [2]

  2. Infosecurity Magazine reported that three ConnectWise cloud services were offline. [1]

  3. Sophos News published an analysis of automated sign-ins using the Cloud Backup application identity. [4]

  4. The Hacker News reported that ConnectWise had disabled seven application identities, including Cloud Backup. [3]

Sources

  1. [1]Infosecurity Magazine · Oct 19, 10:30 UTC
    ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenantscontext
  2. [2]CyberScoop · Oct 20, 16:17 UTC
    ConnectWise customers hit by supply-chain attack linked to compromised API secretcontext
  3. [3]The Hacker News · Oct 18, 08:23 UTC
    ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenantscontext
  4. [4]Sophos News · Oct 19, 00:00 UTC
    ConnectWise Cloud Backup application abused in cross-tenant token sweepcontext