Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

{"heading_1":"Background on the Breach","paragraph_1":"ConnectWise's Cloud Backup service was compromised, allowing hackers to access application identities and gain unauthorized access to Microsoft 365 tenants. This breach highlights the importance of secure application identities and the need for robust security measures.","paragraph_2":"The breach started on October 15, with unauthorized access to application identities in the ConnectWise Cloud Backup environment. ConnectWise shut down application access for its partners and clients, stating that no backup data has been compromised.","paragraph_3":"Huntress identified at least 162 compromised tenants in its environment, with the malicious activity originating from a single IP address: 144.172.64[.]128. The attackers used automated scripts to gain access to Microsoft 365 tenants, bypassing multi-factor authentication.","paragraph_4":"Todyl researchers noted that the attackers authenticated directly to Microsoft 365 as the backup application, gaining permissions previously granted to the application. The attackers also established persistence in some tenants, adding credentials to MSP management tools and to Huntress's own application.","paragraph_5":"Microsoft observed persistence activity via a backdoor after successful service principal authentication, followed by reconnaissance and attempts to add additional credentials. The attackers used three user agents linked to the malicious Cloud Backup service activity: python-urllib/3.12, python-requests/2.31, and python-requests/2.34.2.","paragraph_6":"ConnectWise recommends that administrators check service principal sign-ins in Entra, filter by the Cloud Backup application ID, and examine unexpected source addresses. Microsoft and Huntress advise reviewing application credential changes, OAuth grants, and related Graph activity to prevent similar incidents in the future."}