Hackers Exploit Compromised ConnectWise Credentials to Access 173 Microsoft 365 Tenants

Cybersecurity researchers are raising significant concerns regarding an active malicious campaign wherein unidentified threat actors are leveraging compromised Microsoft 365 (M365) credentials associated with ConnectWise Cloud Backup, previously known as SkyKick. This exploitation grants unauthorized access to customers’ M365 environments, intensifying fears over data security and the integrity of managed services.

ConnectWise Cloud Backup serves as a vital backup and recovery service for managed service providers (MSPs), allowing them to safeguard their clients’ data across platforms like Microsoft 365 and Google Workspace. As the application relies on extensive access permissions to user data, including mailboxes, OneDrive, SharePoint, and Teams, the use of compromised credentials poses a severe risk.

Investigative findings by Huntress indicate that unauthorized sign-ins have been confirmed across 173 customer tenants. This widespread breach complicates the security landscape, particularly as the compromised credential enables attackers to traverse multiple tenants where the application is deployed. The actions observed include authentication attempts from a specific IP address, which aligns with scripted access across various targets in rapid succession, signifying organized and methodical exploitation.

The implications of this breach are staggering. Attackers can exploit these credentials to access sensitive information stored within customer environments. This includes not only emails and shared files but also critical directory data. In a troubling development, a ConnectWise application was noted to have improperly elevated its privileges to that of a Global Administrator, adding further vulnerabilities within the tenant environments.

In light of the situation, security experts from various firms have swiftly taken action. Todyl noted that unauthorized parties have managed to authenticate against Microsoft Graph using the ConnectWise application, thus inheriting previously granted permissions that permit extensive data access. Notably, merely revoking user sessions does not suffice to cut off the compromised access, since tokens can remain valid for up to 90 minutes after being issued.

Responding to these alarming findings, ConnectWise has temporarily suspended cloud backup application access while investigations continue. The company has stated that, as of now, there is no evidence indicating that partner backup data has been compromised. It has issued recommendations for users to revoke the application’s access until all credentials have been reset and has advised thorough audits of their tenant environments to identify any recent suspicious activity.

In conjunction with these incidents, further supply chain security issues have emerged globally, notably involving a data backup application known as AOMEI Backupper. Cybersecurity experts have linked these threats, uncovering a pattern of ephemeral tampering which has affected numerous sectors internationally.

As this situation evolves, it serves as a timely reminder of the critical need for vigilant cybersecurity measures and proactive risk management as organizations navigate increasingly complex digital landscapes.

#business #technology #politics