Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Summary
Threat actors are exploiting a compromised Microsoft 365 credential from ConnectWise Cloud Backup to gain unauthorized access to customer M365 environments. This credential abuse allows attackers to infiltrate multiple tenants, posing a significant risk to MSPs and their clients.
IFF Assessment
The compromise of a widely used MSP tool's credentials by threat actors directly enables unauthorized access and potential damage to client environments, representing a threat to defenders.
Defender Context
This incident highlights the critical importance of supply chain security for MSPs and the potential impact of a single compromised credential. Defenders should be vigilant about monitoring for unusual M365 login activity, especially from MSP partners, and enforce robust multi-factor authentication across all privileged accounts.