Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Summary
ConnectWise has temporarily disabled access to its Cloud Backup service following a supply-chain attack. Hackers exploited compromised application identities to gain access and subsequently breach Microsoft 365 tenants.
IFF Assessment
This incident represents a significant security failure, as attackers were able to compromise a supply chain vendor to gain access to customer Microsoft 365 tenants, indicating a successful offensive operation.
Defender Context
This incident highlights the critical risks associated with supply chain attacks, where compromising a single vendor can lead to widespread impact on their customers. Defenders should focus on robust third-party risk management, including thorough vetting of vendor security practices and strict access controls for integrated applications.