ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Summary
ConnectWise has suspended its cloud backup service after threat actors gained unauthorized access to its application identities and compromised Microsoft 365 tenants. The company has disabled seven ConnectWise application identities as part of its ongoing investigation into the incident.
IFF Assessment
FOE
This incident involves unauthorized access and compromise, indicating a win for attackers and a setback for defenders.
Defender Context
This incident highlights the risks associated with third-party cloud services and the importance of robust identity and access management. Defenders should be vigilant about potential impacts on their own ConnectWise cloud backup instances and review their Microsoft 365 tenant security configurations.