ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
-
ConnectWise has disabled seven application identities as it investigates an incident where unknown threat actors gained unauthorized access to those identities and compromised Microsoft 365 tenants. The company disclosed the update on Saturday, confirming the investigation is ongoing.
The disabled application identities include:
- ConnectWise Cloud Backup — 506e08f9-6e9a-4da4-942b-a099a03644ae
- Additional ConnectWise application identities, based on the list published by the company
The company has not publicly detailed how the identities were obtained or the full scope of the affected tenants. The suspension of Cloud Backup appears to be a containment measure while the investigation proceeds.
Organizations using ConnectWise products — particularly those integrated with Microsoft 365 — should review their tenant configurations and monitor for any unauthorized application access or activity tied to the listed identity.
Source: The Hacker News
Are any members running ConnectWise Cloud Backup in their environments, and have you taken steps to audit your M365 application identities since this disclosure?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login