How the Breach Occurred

Cybercriminals exploited a vulnerability within ConnectWise's Cloud Backup service, a platform used by managed service providers (MSPs) to safeguard customer data in cloud environments like Microsoft 365. The attackers gained unauthorized access to application identities, specifically service principals within Microsoft Entra ID. These service principals act as credentials for applications to access tenant data. By compromising these identities, the attackers were able to authenticate directly to Microsoft 365 tenants, bypassing multi-factor authentication as the access was application-based, not user-based. This supply-chain intrusion allowed them to operate with the permissions already granted to the ConnectWise Cloud Backup application.

What Data Was Exposed & Consumer Risks

  • Corporate tenant data, including emails and files stored in Microsoft 365.
  • Administrative privileges within compromised Microsoft 365 tenants.
  • Potential for further unauthorized access, data exfiltration, or malicious modifications.
  • Risk of credential harvesting and lateral movement within affected organizations.
  • Disruption of backup and recovery services, impacting business continuity.

Protective Steps for Affected Consumers

Organizations utilizing ConnectWise's Cloud Backup service, or any MSP-provided cloud backup solution, should take immediate action. Review Microsoft Entra ID for any suspicious activity related to the ConnectWise Cloud Backup application ID (506e08f9-6e9a-4da4-942b-a099a03644ae) and other related ConnectWise Cloud Management application IDs. Examine service principal sign-ins for unexpected source IP addresses and user agents. It is crucial to audit all application credentials, secrets, and certificates for unauthorized additions since mid-October and remove any suspicious entries. While ConnectWise has temporarily disabled access to the service, existing compromised credentials may still be active. Consider disabling the implicated ConnectWise applications within your tenant as a precautionary measure. Stay informed by monitoring official advisories from ConnectWise and Microsoft for further guidance and remediation steps.