ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
Do not reconnect affected applications until ConnectWise provides formal restoration instructions." Huntress has shared the following IP addresses observed in connection with the activity, adding that the password spray and failed login attempts linked to some of them are unlikely to be related to the application sign-in activity - "In a review of application sign-ins across more than 10,000 tenants with ConnectWise applications (where we can see those logs), 144.172.64[.]128 and Microsoft-internal ranges are the only addresses that produced application sign-in activity," Huntress researchers said in an update.
We did see password spray and failed login attempts from some of them." The cybersecurity company said it also observed post-compromise actions on a second tenant, following the same modus operandi as before , in which the application granted itself Global Administrator and then added a new secret on a small number of other applications in the tenant for persistence.
There is no evidence that any ConnectWise products and services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.
While the access may have been used for Microsoft Graph directory reads, there are no signs the attackers weaponized it for mailbox or file manipulation, or to make user or policy changes.
Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated.
The only consistent criteria we can point to is structural: credentials were planted in applications that are registered inside the affected tenant, without regard to what those applications can actually do."
The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m.
UTC, three days after the incident was first identified - ConnectWise said it's validating the effectiveness of its containment measures and emphasized that it has not seen any successful threat activity in the environments it monitors.
What happened
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
Do not reconnect affected applications until ConnectWise provides formal restoration instructions." Huntress has shared the following IP addresses observed in connection with the activity, adding that the password spray and failed login attempts linked to some of them are unlikely to be related to the application sign-in activity - "In a review of application sign-ins across more than 10,000 tenants with ConnectWise applications (where we can see those logs), 144.172.64[.]128 and Microsoft-internal ranges are the only addresses that produced application sign-in activity," Huntress researchers said in an update.
What changed
We did see password spray and failed login attempts from some of them." The cybersecurity company said it also observed post-compromise actions on a second tenant, following the same modus operandi as before , in which the application granted itself Global Administrator and then added a new secret on a small number of other applications in the tenant for persistence.
Who is affected
There is no evidence that any ConnectWise products and services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.
While the access may have been used for Microsoft Graph directory reads, there are no signs the attackers weaponized it for mailbox or file manipulation, or to make user or policy changes.
Why it matters
Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated.
The only consistent criteria we can point to is structural: credentials were planted in applications that are registered inside the affected tenant, without regard to what those applications can actually do."
Response
The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m.
What security teams should do
UTC, three days after the incident was first identified - ConnectWise said it's validating the effectiveness of its containment measures and emphasized that it has not seen any successful threat activity in the environments it monitors.
Attribution
The Hacker News: ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.
What to watch next
Watch for updated vendor guidance and fixed-version details.