ConnectWise recently cut access to their Cloud Backup and a few other services, citing a suspected supply chain attack targeting Microsoft 365 customers. This cyberattack on ConnectWise’s backup solutions reveals how some aspects of data security can remain hidden from the end user, chained through a line of suppliers and service providers they never interact with.
What is affected?
The outage affects CW’s SaaS Security and Cloud Management but is especially around their Cloud Backup, previously known as SkyKick. They claim no observed successful threat activity since October 17, however, implying the incident is now under control.
What went wrong?
Microsoft Threat Intelligence on Saturday confirmed it was tracking an active supply-chain attack involving the compromise of a trusted OAuth App for ConnectWise Cloud Backup, according to a post on X.
ConnectWise Cloud Backup is a multitenant vendor application, Microsoft said, noting that customers grant permission for the application to operate in their respective tenants. Microsoft researchers assess that the hacker “likely abused permissions previously granted by customers” to the application.
Microsoft said it detected “broad successful principal authentication” on Thursday from the IP address 142.172.64[.]128. It also picked up Microsoft Graph API reconnaissance and attempts from the threat actor to add additional credentials in order to maintain access as a backdoor, according to the post.
Who is affected?
While no firm numbers exist, a few independent voices give us a broad idea. Huntress, a Maryland-based managed security platform, claims on their blog 162 unauthorized tenant sign-ins. There were breach attempts on over 1000 M365 accounts, successful in about 300 of them. Another platform, Todyl, also reported impacts from the same attack.
The numbers are therefore not catastrophic – rather, what should be noted is the breadth of who is affected downstream of the initial service and how these systems interconnect.
What next?
Detection is step one. As with any identity compromise, the first hints will be strange behavior from accounts that is out of pattern, including attempts to access information they have no business need for. These compromised accounts may try to escalate their own privileges or otherwise gain access to deeper systems.
ConnectWise themselves recommend the following:
- Preserve available sign-in and audit records, while taking urgent action to contain.
- Review application and user authentication, application credentials and federation trusts.
- Check for unauthorized mailbox forwarding, inbox rules or delegated mailbox access.
- Investigate any other identities changed or used during suspicious activity.
Your Data in Your hands – With TECH-ARROW
by Matúš Koronthály
Image generated by Canva
