Unauthorized access prompts ConnectWise, which turns off SaaS backup, security and management services to probe snafu
Services suspended after discovery
ConnectWise said it began a service interruption after identifying unauthorized access to application identities in its Cloud Backup environment. The company published an advisory on October 16, saying it had made the discovery the previous day.
The suspension covers Cloud Backup, formerly known as SkyKick, as well as SaaS Security and Cloud Management, which are integrated with the backup service. ConnectWise said the services would remain suspended while its investigation and remediation continued.
Different accounts of customer risk
ConnectWise said the suspension was a precaution and did not establish that managed service providers or their customers had been compromised. Jason Ferguson, the company’s vice president of security operations, said existing archives remained encrypted, isolated and preserved, with no evidence of unauthorized access.
Huntress described a more direct threat, saying a Microsoft 365 API secret belonging to ConnectWise Cloud Backup had been compromised and was being used to access customers’ Microsoft 365 environments. The accounts differ on whether unauthorized access had reached customer environments.
Huntress urges credential review
Huntress warned that disabling Microsoft 365 applications, including the ConnectWise apps involved, would not remove credentials that had already been added. The firm advised customers to review credentials across all their Microsoft 365 applications.
ConnectWise said its teams were monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation. It also called on customers to probe the Microsoft 365 environments they manage for signs of compromise.
Why service providers attract attackers
Managed service providers can deliver packaged services that customers do not need to operate themselves. Some organizations may also not know which platforms their MSPs use, and MSPs are not required to disclose them.
Companies serving MSPs can be appealing targets because a breach may provide a path to their partners and those providers’ end-users. The 2021 attack on Kaseya was cited as a prominent example of this kind of incident.
Key points
- ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management after finding unauthorized access to application identities.
- ConnectWise said it had no evidence of unauthorized access to existing archives and did not confirm customer environments were compromised.
- Huntress said a compromised Microsoft 365 API secret was being used to access customers’ environments.
- Huntress urged customers to review credentials across all their Microsoft 365 applications.