ConnectWise Cloud Backup application abused in cross-tenant token sweep
Summary
Attackers are exploiting a vulnerability in ConnectWise's cloud backup application by using its Entra application identity to request Microsoft Graph tokens across multiple tenants. This allows them to gain unauthorized access to data in those tenants.
IFF Assessment
This vulnerability allows attackers to gain unauthorized access to sensitive data by abusing a legitimate application's credentials, posing a significant threat to defenders.
Defender Context
This incident highlights the risks associated with granting broad permissions to third-party applications, especially those with access to sensitive cloud environments like Microsoft 365. Defenders should carefully review the permissions granted to all integrated applications and implement strict monitoring for anomalous token requests and cross-tenant access.