ConnectWise has temporarily suspended its Cloud Backup, SaaS Security, and Cloud Management services following a cybersecurity incident. This decision came after a compromised credential was used to gain unauthorized access to customers’ Microsoft 365 tenants.
Details of the Service Shutdown
On October 17, ConnectWise shut down its Cloud Backup service, previously known as SkyKick, approximately 12 hours after detecting unusual activity. The company reported unauthorized access to application identities within its Cloud Backup environment and took immediate action to prevent further breaches.
Subsequently, ConnectWise extended the suspension to include SaaS Security and Cloud Management services to implement necessary security measures. Despite the shutdown, the company assured that customers’ backups remained encrypted and secure, with no evidence of unauthorized data access.
Impact and Ongoing Investigation
The suspension of these services has affected scheduled backups, archive access, and restore processes. Additionally, SaaS Security monitoring and alerting, along with Cloud Management user and license management, have been impacted. ConnectWise has yet to provide a timeline for when services will be fully restored.
To assist customers, ConnectWise released information about the IP addresses involved in the breach and offered guidance for reviewing Microsoft 365 environments. Cybersecurity firm Huntress noted the misuse of the compromised credential to access Microsoft 365 tenants on October 15, with unauthorized sign-ins recorded across multiple tenants.
Analysis by Cybersecurity Experts
Huntress identified that the initial activity stemmed from an IP address linked to prior attacks on law firm tenants. The attackers utilized Microsoft Graph tokens to move through tenants systematically, hinting at a scripted approach. ConnectWise’s Cloud Management app was observed making unauthorized changes to a Global Administrator role within a customer tenant.
By October 17, Huntress detected sign-in attempts in nearly 1,000 Entra tenants from the attacker’s IP, with more than 300 successful attempts. However, access was limited in tenants without the relevant ConnectWise service principal. The attack also involved ConnectWise Cloud Management Exchange Online, MS Teams, and SharePoint Online applications, all of which have been disabled.
Future Outlook and Security Advice
While ConnectWise has contained the breach, businesses must ensure that no malicious changes were made to their Microsoft 365 configurations. CoreView VP of Security Strategy, Kasper Lindgaard, emphasized the need for organizations to verify their configurations, as many falsely assume Microsoft automatically backs up these settings.
Related security issues include a critical Fortinet bug linked to a telecom hack and a zero-click spyware delivery channel operated by an Israeli ad firm. Microsoft also recently addressed multiple remote code execution vulnerabilities in its Office suite.
