ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU
Summary
ConnectWise has temporarily disabled its ScreenConnect services, including backup, security, and management, to investigate a security incident. This action follows an allegation from Huntress regarding the takeover of M365 accounts.
IFF Assessment
FOE
The temporary shutdown of critical security and management services by ConnectWise indicates a significant security incident, which is detrimental to defenders.
Defender Context
This incident highlights the critical need for robust monitoring and rapid incident response for service providers. Defenders should be aware of potential supply chain risks and ensure their own security postures are resilient, even when relying on third-party services.