ConnectWise Takes Cloud Services Offline After Attackers Access Backup App Identities

IT management software provider ConnectWise has taken several cloud services offline after discovering unauthorised access to application identities within its Cloud Backup environment (previously known as SkyKick). The company began investigating suspicious activity on 15 October and confirmed the unauthorised access by 17 October. Cloud Backup, SaaS Security and Cloud Management are all affected while the investigation continues.

In an update on 19 October, ConnectWise acknowledged that the outage affects the ability of its partners to support their customers. It has not confirmed when services will return and says it will share a timeline once it can do so reliably.

The concern is that an attacker could use this access to reach customers' Microsoft 365 environments. By signing in as the backup app, they could obtain tokens carrying the app's existing permissions. Justin Kohler of SpecterOps explained that the credential belongs to the application itself, so the attacker inherits its permissions. Multi-factor authentication does not apply to an application sign-in, as no user, device or MFA prompt is involved. Because backup tools need broad access to read and restore data, anyone holding the credential could reach mailboxes, OneDrive and SharePoint files, Teams data and directory information. This article covers only the opening of the source report, so further details may emerge as the investigation progresses.