ConnectWise Suspends Cloud Services After Credential Compromise

ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services after identifying unauthorized access to application identities within its environment. The company initiated the shutdown on October 17 as a protective measure for partners and their clients. This action impacts scheduled backups, archive access, restores, and monitoring alerts for managed service providers.

The risk

The intrusion occurred when attackers abused a compromised credential to access customers’ Microsoft 365 tenants. According to cybersecurity firm Huntress, the Cloud Backup identity signed into 162 tenants between October 15 and October 16. The authentication originated from Microsoft’s own sign-in logs using a client assertion credential stored in the vendor’s tenant. This means customer actions could not have produced the credential or the access.

Who is exposed

The activity originated from an IP address previously used for password spraying against law firms. In one tenant, the ConnectWise Cloud Management app added itself to the Global Administrator role. It then ran a script to add new client secrets to an MSP management application and Huntress’s application. This access came from Microsoft’s internal cloud network rather than the attacker’s external IP address.

Cost and compliance

ConnectWise stated that customer backups remain encrypted and protected. The company reported no evidence of unauthorized access to the backup data itself. However, the containment measures continue to disrupt scheduled backups, archive access, and restores. SaaS Security monitoring and alerting, along with Cloud Management license functions, are also unavailable. No estimated restoration timeline has been provided.

What happens next

Managers should review the IP addresses ConnectWise shared regarding the intrusion. Teams need to verify Microsoft 365 environments for unauthorized changes to administrative roles. Organizations should monitor for new client secrets added to management applications. Until services are restored, alternative backup and security monitoring methods are necessary.

Questions to ask your suppliers

Ask your managed service provider whether they have reviewed their Microsoft 365 administrative logs for unauthorized role changes. Determine if any new application secrets were added to your management tools during the incident window. Verify that your provider has rotated all relevant credentials and confirmed the integrity of their application identities. Inform your legal and compliance teams immediately to assess potential data exposure liabilities. Establish a direct communication channel with your vendor to receive timely updates on service restoration and remediation steps.

Background: Password spraying

Password spraying is an attack where threat actors use a single common password against many user accounts. This method avoids triggering account lockouts that block brute force attacks. You must enforce multi-factor authentication to stop this specific threat vector effectively.

Read the full guide: What Is Password Spraying: Mechanism, Risks, and Defense

What to do and how to stay safe: ConnectWise

• Review Microsoft 365 sign-in logs for any activity originating from the IP addresses published by ConnectWise.
• Audit administrative roles in your tenant to ensure no unauthorized applications have Global Administrator privileges.
• Rotate any client secrets or credentials associated with your MSP management applications.
• Monitor for unexpected changes to application permissions until the vendor confirms full remediation.

Step-by-step guide: Implement MFA for Cloud Accounts: A Step-by-Step Rollout Plan

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers access the actual backup data?

ConnectWise stated there is no evidence of unauthorized access to encrypted customer backups.

How many Microsoft 365 tenants were accessed?

Huntress reported the Cloud Backup identity signed into 162 Microsoft 365 tenants.

When was the intrusion detected?

ConnectWise began investigating suspicious activity on October 17 before suspending services.