ConnectWise Supply-Chain Attack Leads to Breach of Over 170 Microsoft 365 Tenants
Hackers leveraged compromised ConnectWise Cloud Backup credentials to access Microsoft 365 environments of at least 173 organizations, bypassing MFA protections.
A supply-chain cyberattack targeting ConnectWise has enabled unauthorized threat actors to gain access to customer Microsoft 365 environments at an alarming scale.
Abuse of Application Credentials
Threat actors reportedly stole and exploited credentials associated with the ConnectWise Cloud Backup application. By utilizing these compromised credentials, the attackers managed to breach the Microsoft 365 tenants of at least 173 organizations.
Bypassing Multi-Factor Authentication
The attackers executed the breach by directly abusing service principal application permissions. This technical approach granted significant advantages to the perpetrators, allowing them to:
- Completely bypass Multi-Factor Authentication (MFA) requirements
- Circumvent standard user-level security controls and monitoring
Scope and Impact of the Breach
Because the supply-chain incident targeted cloud-based backup services with deep infrastructure access, the intruders obtained the capability to directly view and read sensitive organizational assets, including:
- Corporate emails
- Stored files within OneDrive
- Data and documentation hosted on SharePoint
- Internal communications within Microsoft Teams
Who Should Take Action
This incident is of paramount importance to IT administrators, Managed Service Providers (MSPs), and any organizations currently deploying ConnectWise Cloud Backup solutions integrated with Microsoft 365. Stakeholders are advised to review and monitor their environments closely.
Source: BleepingComputer