Supply-Chain Attack on ConnectWise Cloud Backup

ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.

A threat actor obtained a credential (API secret) belonging to ConnectWise Cloud Backup, and ConnectWise has confirmed that it is being used to gain unauthorized access to customers’ Microsoft 365 environments. The speed with which the threat actor gained initial access across the affected organizations suggests that this part of the attack was automated.

In one case, the threat actor not only accessed the victim organization’s environment but also granted itself the Global Administrator role and added new credentials to two other applications in the tenant, ensuring additional persistence. [1] Recommended Actions The blast radius of a large supply-chain attack like this may be considerable.

ConnectWise Cloud Backup is officially marketed as a backup solution for MSPs, which means that if a threat actor breaches an MSP, the MSP’s customers may subsequently be compromised in further supply-chain attacks. Nothing is known yet about the threat actor behind the attack.

However, the fact that additional persistence was established in only one of the 173 identified victims suggests that the actor may have a relatively narrow primary target list, which is consistent with the modus operandi of an espionage actor. For ConnectWise Cloud Backup Users ConnectWise has reportedly taken its cloud backup service offline.

Any organization using ConnectWise Cloud Backup should disable the service in its systems until ConnectWise has reset all credentials and confirmed that the service is safe to use again. Immediate victims that use ConnectWise Cloud Backup should also conduct threat hunting for the IOCs listed below. More details on how to protect your environment are available in a Microsoft blog post.