Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Hackers abuse compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 tenants. Security firm Huntress warns of potential data breaches.
Intelligence analysis by Qwen 2.5 (3B)
Hackers exploit a compromised ConnectWise Cloud Backup credential to gain unauthorized access to 173 Microsoft 365 tenants, raising concerns about data security.
Hackers used a stolen password to get into a bunch of companies' Microsoft email accounts. This could mean they saw private information.
Analysis
{"heading_1":"The Incident","paragraph_1":"ConnectWise has taken the step of closing Cloud Backup application access until further notice. The company has found no evidence that Cloud Backup partner backup data has been compromised.","paragraph_2":"ConnectWise has shared steps to look for indicators of compromise, including navigating to Monitoring → Sign-in logs in the Microsoft Entra Admin Center and reviewing authentication activity originating from IP addresses outside expected Microsoft/Azure ranges.","paragraph_3":"In at least one partner tenant, the cybersecurity company found a separate ConnectWise app assigning itself Global Administrator privileges and adding credentials to other trusted applications within this environment, thereby opening a pathway to other privileged apps within customer environments.","heading_2":"The Impact","heading_3":"ConnectWise's Response"}
Key points
- Hackers used a stolen ConnectWise Cloud Backup password to access 173 Microsoft 365 tenants.
- The compromised password gave attackers access to sensitive data, including emails and files.
- ConnectWise has taken steps to secure their service and shared steps for users to check for any suspicious activity.
ConnectWise has taken steps to secure their service and customers' data, and users should check their accounts for any suspicious activity.
If the stolen password was used to access other services or data, users may have to change their passwords and be more cautious with their information.
