ConnectWise Cloud Backup Outage Follows Stolen Credential Attack on Microsoft 365 Customers

ConnectWise has suspended its Cloud Backup, SaaS Security and Cloud Management services after a threat actor gained access to a highly sensitive credential. The credential, an API secret, let customers connect the vendor's application to their Microsoft 365 environments. The company shut down the services on Saturday, and some customers have been without access for days, with no confirmed timeline for restoration. The attacker has not been identified.

According to Huntress, the stolen secret was used to compromise customers' Microsoft 365 applications, including Exchange Online, Teams, SharePoint Online, MS Graph and Partner Center. Researchers saw an initial wave of attacks on Friday. By late Saturday, Huntress had seen sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, and more than 300 of those sign-ins appeared to succeed. Huntress confirmed unauthorised sign-ins in 162 tenants and said further compromises beyond its visibility are likely.

ConnectWise says it is investigating and monitoring its environment around the clock. It reports no successful threat activity in the environments it monitors since mitigations began on 17 October at 05:00 UTC. However, it stressed that this does not show whether individual partner or customer Microsoft 365 tenants were affected, and that each potentially affected tenant still needs review.