ConnectWise Cloud Backup Service Hit by Supply Chain Attack, Services Suspended
ConnectWise has suspended its Cloud Backup service after a supply chain attack granted unauthorized access to its environment, impacting customer data protection capabilities.
IT management software provider ConnectWise has suspended its Cloud Backup service, along with its SaaS Security and Cloud Management platforms, following a confirmed supply chain attack. The company announced it was investigating unauthorized access to its Cloud Backup environment on Friday, confirming the breach on Saturday. The incident has led to service interruptions as ConnectWise works to assess the full impact and scope of the compromise.
According to cybersecurity firm Huntress, the attackers compromised a credential belonging to ConnectWise Cloud Backup. This credential was then used to gain unauthorized access to customers' Microsoft 365 environments. Microsoft corroborated these findings, stating that threat actors likely abused highly elevated permissions, such as Directory.ReadWrite.All, which were previously granted by customers to the ConnectWise application.
ConnectWise Cloud Backup is designed to protect data within Microsoft 365 and Google Workspace, requiring broad access to sensitive information like mailboxes, OneDrive, SharePoint, and Teams. This extensive access means that compromised ConnectWise Cloud Backup credentials inherently grant attackers wide-ranging visibility and control over systems where the application is installed, potentially leaving minimal traces of malicious activity.
While ConnectWise stated there is "no indication" that backup data itself was compromised, the company could not determine whether individual customer Microsoft 365 environments were breached due to a lack of visibility into partner and customer systems. In response, ConnectWise has revoked certificates used for affected application connections across all users, invalidating all shared credentials previously used by the Cloud Backup service. They are also conducting ongoing authentication monitoring, permission reviews, and forensic analysis.
Huntress incident responders observed initial password spray attacks on October 13 and 14, followed by a broader wave of activity on October 15 where attackers used ConnectWise's Cloud Management apps to assign themselves directory or administrative roles in approximately 50 monitored systems. In total, Huntress identified unauthorized sign-ins in 162 tenants. A second, more targeted wave of attacks was observed, though many of these tenants did not rely on ConnectWise services, indicating a broader reconnaissance effort.
The implications of such a supply chain attack are significant. If an application like ConnectWise Cloud Backup can assign directory roles, it can elevate itself to Global Administrator status. From this privileged position, an attacker can create new applications, grant them permissions, reset user credentials and authentication methods, and alter security policies like Conditional Access. These actions can establish persistent backdoors that are independent of the initial compromised vendor credential.
ConnectWise has a history of security incidents, including a nation-state attack on its remote management software last year and previous exploits leading to ransomware attacks. The company has not provided a timeline for the restoration of services but reported no successful threat activity since implementing remediation measures. The current service disruptions highlight the critical need for robust security practices and vigilant monitoring within the software supply chain.
This new report indicates that attackers were able to authenticate directly into Microsoft 365 tenants using compromised ConnectWise credentials, a detail not previously specified. While ConnectWise maintains that the full impact on downstream MSPs and their clients is still under investigation, this specific method of credential abuse raises further concerns about the security of third-party access to cloud environments.