IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity companies warned of a supply chain attack impacting its cloud backup system.\u00a0 <\/p>\n
ConnectWise initially said on Friday that it was investigating \u201cattempts of unauthorized access associated with the ConnectWise Cloud Backup environment,\u201d and confirmed such access on Saturday.\u00a0\u00a0 <\/p>\n
Incident responders at cybersecurity firm Huntress said<\/a> a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers\u2019 Microsoft 365 environment.\u00a0 <\/p>\n Microsoft confirmed<\/a> in its own statement that threat actors \u201clikely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.\u201d\u00a0 <\/p>\n ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace. The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.\u00a0 <\/p>\n An attacker using stolen ConnectWise Cloud Backup credentials will inherently have wide access to any systems where the app is installed, including places where no trail of evidence will be left.\u00a0 <\/p>\n ConnectWise did not respond to requests for comment about the attackers or about how many customers were impacted. A spokesperson told Recorded Future News that there is \u201cno indication” that backup data was compromised. <\/p>\n The current service interruptions apply to the cloud backup system as well as the SaaS Security and Cloud Management platforms.\u00a0 <\/p>\n \u201cWe have remediated identified compromised credentials and identities, and we continue authentication monitoring, permission review, and forensic analysis,\u201d the spokesperson said. <\/p>\n In multiple updates throughout Saturday and Sunday, ConnectWise said<\/a> it revoked certificates used for affected application connections across all users. This removed ConnectWise\u2019s access through those connections and all shared credentials previously used for Cloud Backup are no longer valid and cannot be used.\u00a0 <\/p>\n The company said they do not have visibility into partner and customer environments, so they cannot determine whether a particular customer\u2019s Microsoft 365 environment was breached. <\/p>\n ConnectWise said since taking a range of actions, it has seen no successful threat activity. There is no timeline for a restoration of services, the spokesperson said.\u00a0 <\/p>\n Waves of attacks\u00a0<\/p>\n Huntress incident responders said they initially saw password spray attacks against four law firms on October 13 and 14. By October 15, about 50 systems monitored by Huntress saw attackers use ConnectWise’s Cloud Management apps to assign themselves directory or administrative roles.\u00a0 <\/p>\n In total, Huntress saw unauthorized sign-ins in 162 tenants. Huntress also saw a second targeted wave of largely unsuccessful attacks targeting systems \u201cin the policy, national security, trade, and critical mineral sectors.\u201d\u00a0 <\/p>\n \u201cUnlike the first wave of activity outlined in our initial blog below, most of these tenants do not rely on any ConnectWise products. In tenants without the relevant ConnectWise service principal, the attempts failed because the application was not present,\u201d Huntress explained.\u00a0 <\/p>\n Like Huntress, Microsoft and other cybersecurity firms<\/a> said they observed<\/a> \u201cbroad\u201d attacks starting on October 15. <\/p>\n Huntress warned that backup services like ConnectWise Cloud Backup normally hold read access to mail, files, Teams, and directory data so it can copy them and restore them. <\/p>\n \u201cThe larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies,\u201d Huntress added.\u00a0 <\/p>\n \u201cEach of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough.\u201d <\/p>\n They noted that in managed service providers the effect can be even worse \u2014 with attackers using their foothold in one customer to gain access to all other customers.\u00a0 <\/p>\n ConnectWise has dealt with multiple security incidents in the past, including one last year involving a nation-state attack<\/a> on its remote management and monitoring software that impacted some of its customers. <\/p>\n Cybercriminals previously exploited<\/a> multiple vulnerabilities<\/a> in the company\u2019s products that led to ransomware attacks. <\/p>\n","protected":false},"excerpt":{"rendered":"IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity…\n","protected":false},"author":2,"featured_media":934200,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[64,63,105],"class_list":["post-934199","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/934199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=934199"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/934199\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/934200"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=934199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=934199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=934199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}