Security experts have raised alarms about a breach involving unauthorized access to Microsoft 365 accounts. The breach was facilitated through a compromised credential linked to ConnectWise Cloud Backup, formerly known as SkyKick, which is widely used by managed service providers (MSPs) for data protection. This service, designed to safeguard Microsoft 365 and Google Workspace data, grants extensive permissions across mailboxes, OneDrive, SharePoint, Teams, and directory data.
Widespread Impact of Credential Compromise
The breach has affected 173 partner and customer tenants, as confirmed by cybersecurity firm Huntress. The compromised credential has enabled unauthorized sign-ins across these environments. Threat actors have leveraged this access to acquire Microsoft Graph tokens, as noted by security researcher Jonathan Semon. These tokens allow the attackers to exploit the app’s permissions, accessing a wide range of customer data.
Further analysis revealed that the attackers employed their own tools to authenticate, mimicking the backup service operations to gain access to sensitive data. This extensive access means that the attackers can potentially read emails, access files, and manipulate directory data, posing a significant threat to affected organizations.
Escalation of Privileges and Further Risks
In some instances, the compromised ConnectWise app has escalated its privileges, granting itself Global Administrator rights within certain tenant environments. It has also been reported that the app added credentials to trusted applications, which could broaden the security risk beyond the initial breach. This escalation of privileges was highlighted in a specific case involving the ConnectWise Cloud Management app for Microsoft Teams.
Additionally, the same IP address linked to the breach was involved in password spraying attempts against multiple law firm tenants. Although no user sign-ins were successfully compromised during these attempts, the persistence of the threat actors is evident.
Response and Recommendations
In response to the breach, ConnectWise has temporarily disabled access to the Cloud Backup application. The company assures that no partner backup data has been compromised and has provided indicators of compromise for detection. Users are advised to disable the application until credentials are reset, enable Microsoft Graph activity logs, and audit for new credentials added recently.
Meanwhile, a related cybersecurity incident has been reported by Google and its partners, involving a temporary supply chain compromise of AOMEI Backupper’s update infrastructure. This separate attack, attributed to a group dubbed UNC7017, utilized brief tampering windows to redirect software updates to malicious servers.
This developing situation underscores the critical importance of robust security measures and vigilant monitoring to protect against evolving cyber threats. Organizations are encouraged to stay alert and implement recommended security protocols to mitigate potential risks.
