ConnectWise pulled several of its services offline over the weekend in response to a supply chain attack targeting its Cloud Backup offering, following warnings from Microsoft and other security researchers about unauthorized access to the system.
The company first disclosed on Friday that it was examining "attempts of unauthorized access associated with the ConnectWise Cloud Backup environment," before confirming the breach had succeeded on Saturday.
Huntress, a cybersecurity incident response firm, determined that attackers had obtained a credential for ConnectWise Cloud Backup and leveraged it to penetrate customer Microsoft 365 deployments. Microsoft's own statement indicated that threat actors "likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All."
ConnectWise Cloud Backup operates as a cloud-based backup and recovery platform meant to safeguard data stored in Microsoft 365 and Google Workspace. According to Huntress, the service requires extensive permissions across mailboxes, OneDrive, SharePoint, Teams and related systems.
An attacker wielding the stolen ConnectWise Cloud Backup credentials would gain sweeping access to any systems where the application was deployed, potentially without leaving detectable traces of their activity.
ConnectWise declined to comment on the attackers' identity or the scope of affected customers. A company representative told Recorded Future News that there is "no indication" that backup data itself was compromised.
The service disruptions currently affect the Cloud Backup system alongside the SaaS Security and Cloud Management platforms. The company stated: "We have remediated identified compromised credentials and identities, and we continue authentication monitoring, permission review, and forensic analysis."
Throughout Saturday and Sunday, ConnectWise issued multiple updates describing how it revoked certificates used for affected application connections across its user base. The company invalidated all shared credentials previously used for Cloud Backup, rendering them unusable.
ConnectWise acknowledged it lacks visibility into partner and customer systems, preventing it from determining whether specific customer Microsoft 365 environments experienced a breach. The vendor reported no successful threat activity since implementing remediation steps, though it provided no timeline for restoring services.
Waves of attacks
Huntress researchers initially detected password spray attacks targeting four law firms on October 13 and 14. By October 15, roughly 50 systems under Huntress monitoring showed attackers using ConnectWise's Cloud Management applications to grant themselves directory or administrative roles.
Huntress documented unauthorized sign-ins across 162 tenants total. The firm also identified a second wave of largely unsuccessful attacks aimed at systems "in the policy, national security, trade, and critical mineral sectors."
Huntress explained: "Unlike the first wave of activity outlined in our initial blog below, most of these tenants do not rely on any ConnectWise products. In tenants without the relevant ConnectWise service principal, the attempts failed because the application was not present."
Microsoft and other security vendors independently observed "broad" attacks beginning on October 15, consistent with Huntress's findings.
Huntress cautioned that backup services such as ConnectWise Cloud Backup typically maintain read access to mail, files, Teams and directory information to enable copying and restoration functions.
The firm elaborated on the escalation risk: "The larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies. Each of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough."
Huntress noted that managed service providers face heightened risk, as attackers gaining a foothold in one customer environment could potentially pivot to access all other customers.
ConnectWise has experienced multiple security incidents previously, including a nation-state attack on its remote management and monitoring software last year that affected certain customers. Cybercriminals have also previously exploited multiple vulnerabilities in the company's products to launch ransomware campaigns.
