ConnectWise Cloud Backup Breach: What We Know
Brief
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick , after researchers detected the applications authenticating into customer Microsoft 365 environments.
A vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS Security, and Cloud Management while investigation and remediation continue.
What Happened in the ConnectWise Incident?
After ConnectWise disclosed the incident on October 16 , researchers provided additional technical details showing that suspicious activity had begun at least a day earlier. On October 15 , Huntress observed the ConnectWise Cloud Backup application authenticating from 144.
- 64[.