ConnectWise backup credentials exposed multiple Microsoft 365 tenants
Summary
ConnectWise has disabled cloud services and is investigating unauthorized access to Microsoft 365 tenants after a credential for its Cloud Backup platform was compromised. This allowed attackers to authenticate into customer tenants, with security firm Huntress identifying suspicious sign-ins across 162 organizations.
IFF Assessment
The compromise of ConnectWise backup credentials allowed unauthorized access to customer Microsoft 365 environments, representing a significant security incident for defenders.
Defender Context
This incident highlights the critical importance of securing integration credentials and API access within third-party backup solutions. Defenders should actively monitor for unusual authentication patterns originating from trusted vendor applications and ensure their cloud backup solutions have robust access controls and MFA.