Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
-
ConnectWise has taken its Cloud Backup service (previously known as SkyKick Cloud Backup) offline after attackers gained access to application identities and used them to compromise Microsoft 365 tenants. Customer access to the service has been shut down while the company responds to the incident.
The attack is being treated as a supply-chain compromise, with the intruders leveraging application identities tied to the backup platform to reach downstream Microsoft 365 environments. Details on the full scope of affected tenants have not been disclosed.
- ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) is currently unavailable to customers
- Attackers accessed application identities and compromised Microsoft 365 tenants
- The incident is classified as a supply-chain attack
Organizations using the service should watch for further guidance from ConnectWise and review their Microsoft 365 tenant configurations and application consent settings for anything unexpected.
Source: BleepingComputer
Has your organization reviewed its third-party application permissions in Microsoft 365 since this disclosure?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login