Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
-
Researchers are tracking an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 credential tied to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customer M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs).
According to the reporting, the stolen credential was used to sign in to 173 Microsoft 365 tenants. Because the service is designed for MSPs, a single compromised credential can potentially expose the environments of many downstream customers at once, which is what makes this campaign notable.
Key points from the report:
- The credential belongs to ConnectWise Cloud Backup, previously known as SkyKick.
- Attackers used it to authenticate into customer Microsoft 365 environments.
- Sign-ins were recorded across 173 tenants.
- The actors behind the campaign remain unknown.
- No specific CVE ID or advisory identifier was provided in the source report.
If your organization uses ConnectWise Cloud Backup or works with an MSP that does, it is worth reviewing tenant sign-in logs and auditing access associated with the service. No formal mitigation guidance beyond that was included in the reporting.
Source: The Hacker News
Does your organization rely on ConnectWise Cloud Backup or an MSP that does, and have you checked your tenant logs since this report?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login