According to The Register, ConnectWise initiated a service interruption for several offerings on October 16 after detecting unauthorized access to application identities within its ConnectWise cloud backup environment. The company suspended operations to probe a security incident, leaving end-users unable to perform backups or restore data.
Key takeaways
- ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management tools due to unauthorized access.
- The suspension began after an advisory was published on October 16 following an incident on October 15.
- Security firm Huntress reported a compromised Microsoft 365 credential belonging to the backup service.
- ConnectWise has disabled specific app integrations while forensic analysis and threat hunting continue.
What happened during the ConnectWise cloud backup incident?
ConnectWise offers enterprise resource planning and management tools for managed services providers, including a tool previously known as SkyKick. On October 15, the firm identified unauthorized access to application identities inside its Cloud Backup environment. Because SaaS Security and Cloud Management are integrated with the backup platform, those tools were also suspended out of an abundance of caution.
As of 16:00 UTC on October 18, the affected platforms remained offline. Jason Ferguson, the company's veep of security operations, shared on Reddit that existing archives remain encrypted and preserved, showing no evidence of unauthorized access. The organization also published indicators of compromise linked to specific IP addresses and third-party app integrations.
What did Huntress find about the unauthorized access?
Security outfit Huntress published a starker view of the security incident, stating that a Microsoft 365 credential and API secret belonging to the backup service was compromised. Huntress confirmed this secret was used to gain unauthorized access to customer M365 environments. In one partner tenant, a second application gave itself Global Administrator rights and added new credentials to other apps.
Huntress warned that disabling M365 apps will not remove credentials that were already added. Administrators must review credentials on all M365 applications to ensure security. Meanwhile, ConnectWise stated it cannot discuss threat actor attribution while its investigation and remediation efforts are ongoing.
What happens next for affected partners?
Because ConnectWise operates as a platform provider, it does not manage end-user relationships directly and must rely on MSP clients to investigate their own M365 environments for signs of compromise. Attackers frequently target businesses that serve MSPs to find a route into multiple service providers and their clients. The 2021 Kaseya attack remains a notorious example of such an incident, leaving ConnectWise and its partners dealing with a difficult situation.
Frequently asked questions
ConnectWise detected unauthorized access to application identities within its Cloud Backup environment on October 15, prompting the company to suspend several offerings while investigating the security incident.
The service interruption affects Cloud Backup, alongside SaaS Security and Cloud Management, which were suspended out of caution because they are integrated with the backup platform.
No, as of October 18, the services remain unavailable, meaning end-users cannot back up data, access archives, or restore data, though existing archives remain encrypted and preserved.
Huntress confirmed that a Microsoft 365 credential belonging to the backup service was compromised and used to gain unauthorized access to customer M365 environments, granting admin rights in some cases.
ConnectWise is relying on its MSP clients to probe any M365 environments they manage for signs of compromise, as the platform provider lacks knowledge of those specific customer setups.
Based on reporting by The Register. Read the original article
