ConnectWise has initiated a series of security measures following a security breach that affected its Cloud Backup service. The company announced on Monday that it has reset application credentials and bolstered protections for administrative access as part of its ongoing response efforts.
Since the breach was first detected, ConnectWise has taken decisive actions to mitigate the impact. Beginning on October 17 at 5:00 a.m. UTC, the company disabled compromised application connections, suspended Cloud Backup, SaaS Security, and Cloud Management, and engaged third-party specialists for assistance in incident response and recovery.
Comprehensive Security Measures
ConnectWise has emphasized the importance of validating the effectiveness of its containment strategies. The company has reported no successful threat activities within its monitored environments, aside from the previously mentioned services. However, it warns that individual Microsoft 365 tenants may still be at risk.
Partners are urged to preserve evidence, validate their findings, and assess any operational consequences before making changes. ConnectWise advises against reconnecting affected applications until official guidance for restoration is provided.
Insights from Huntress
Huntress, a cybersecurity firm, has identified several IP addresses linked to the breach, noting that the main application sign-in activity originated from 144.172.64[.]128. Other addresses in the same provider range showed password spray attempts and login failures, but no direct sign-in activity.
The analysis revealed that post-compromise activities on a second tenant closely mirrored earlier patterns, involving unauthorized Global Administrator grants and the addition of new secrets to applications for persistence. Despite these actions, there is no evidence of data manipulation or unauthorized changes to policies or user permissions.
Future Implications and Partner Guidance
ConnectWise continues to focus on ensuring the security of its services and assisting partners in mitigating potential risks. The company’s detailed response strategy highlights its commitment to transparency and proactive risk management.
As the situation develops, partners are encouraged to stay informed through official communications from ConnectWise and to implement recommended security practices to safeguard their environments.
