ConnectWise has suspended three cloud services following a cybersecurity incident in which attackers exploited compromised application credentials to gain unauthorized access to customer Microsoft 365 environments, disrupting backup, security monitoring, and administrative operations.
The company recently began looking into suspicious activity before suspending its Cloud Backup service. It subsequently took SaaS Security and Cloud Management offline as additional precautions while investigating the intrusion and implementing security measures.
According to ConnectWise’s official incident updates, scheduled backups, access to existing backup archives, and restoration capabilities remain unavailable. The interruption also affects SaaS Security monitoring and alerting, along with Cloud Management functions used to administer users and licenses.
The company has not provided an estimated restoration date.
ConnectWise said it identified unauthorized access involving application identities associated with its Cloud Backup platform. These identities allow the service to authenticate with Microsoft 365 environments and perform authorized operations on behalf of customers.
On October 17, the company disabled seven associated application identities and revoked certificates used for affected connections, preventing further authentication through those credentials.
However, ConnectWise warned that previously issued access tokens could remain usable until expiration or invalidation. Attackers may also have established separate credentials or permissions that require additional investigation and removal.
The company engaged third-party forensic specialists to assist its investigation and said it had not observed successful threat activity in monitored environments since implementing containment measures on October 17.
Security researchers at Huntress independently confirmed that a compromised ConnectWise Cloud Backup credential was used to authenticate to Microsoft 365 tenants on October 15.
The researchers initially identified unauthorized sign-ins across 162 Microsoft 365 tenants. Subsequent analysis revealed authentication activity originating from a suspicious IP address across almost 1,000 Microsoft Entra tenants, with more than 300 successful sign-ins.
Huntress cautioned that successful authentication did not necessarily indicate that attackers gained access to every affected environment, particularly where the relevant ConnectWise application was not installed.
The investigation also uncovered evidence of attempts to maintain unauthorized access.
In two customer environments examined by Huntress, application activity involved granting Global Administrator privileges and adding new credentials to other applications. Such modifications could allow attackers to retain access even after the original compromised credential is disabled.
Researchers said they had not conclusively linked every phase of the suspicious activity to the same attacker.
The compromised application credentials are particularly concerning because cloud backup and management services typically require extensive permissions across Microsoft 365 environments, including access to Exchange Online, SharePoint, Teams, and directory information.
Those permissions could potentially expose sensitive business communications, files, and administrative settings, depending on the access granted to each application.
ConnectWise emphasized that existing Cloud Backup archives remain encrypted, isolated, and preserved, with no indication that the stored backups were compromised. However, the company acknowledged that its investigation into backup infrastructure cannot independently establish whether individual customers’ live Microsoft 365 environments experienced unauthorized activity.
In its latest security advisory, ConnectWise said it was strengthening administrative access protections, resetting accounts, and replacing application credentials as part of its remediation efforts. The company plans to restore affected services in controlled phases once security validation is complete.
They urge managed service providers and customer administrators to review Microsoft 365 application sign-in logs, examine unexpected permission changes, and investigate potentially unauthorized credentials. Administrators have been instructed to keep affected applications disabled until ConnectWise issues formal restoration and reconnection guidance.
Its published technical investigation and remediation guide also recommends checking for suspicious administrative role assignments and persistence mechanisms involving other application identities.
Leave a Reply