ConnectWise suspends Cloud Backup service after supply chain attack

IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity companies warned of a supply chain attack impacting its cloud backup system. 

ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.  

Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment. 

Microsoft confirmed in its own statement that threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.” 

ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace. The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress. 

An attacker using stolen ConnectWise Cloud Backup credentials will inherently have wide access to any systems where the app is installed, including places where no trail of evidence will be left. 

ConnectWise did not respond to requests for comment about the attackers or about how many customers were impacted. A spokesperson told Recorded Future News that there is “no indication" that backup data was compromised.

The current service interruptions apply to the cloud backup system as well as the SaaS Security and Cloud Management platforms. 

“We have remediated identified compromised credentials and identities, and we continue authentication monitoring, permission review, and forensic analysis,” the spokesperson said.

In multiple updates throughout Saturday and Sunday, ConnectWise said it revoked certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections and all shared credentials previously used for Cloud Backup are no longer valid and cannot be used. 

The company said they do not have visibility into partner and customer environments, so they cannot determine whether a particular customer’s Microsoft 365 environment was breached.

ConnectWise said since taking a range of actions, it has seen no successful threat activity. There is no timeline for a restoration of services, the spokesperson said. 

Waves of attacks 

Huntress incident responders said they initially saw password spray attacks against four law firms on October 13 and 14. By October 15, about 50 systems monitored by Huntress saw attackers use ConnectWise's Cloud Management apps to assign themselves directory or administrative roles. 

In total, Huntress saw unauthorized sign-ins in 162 tenants. Huntress also saw a second targeted wave of largely unsuccessful attacks targeting systems “in the policy, national security, trade, and critical mineral sectors.” 

“Unlike the first wave of activity outlined in our initial blog below, most of these tenants do not rely on any ConnectWise products. In tenants without the relevant ConnectWise service principal, the attempts failed because the application was not present,” Huntress explained. 

Like Huntress, Microsoft and other cybersecurity firms said they observed “broad” attacks starting on October 15.

Huntress warned that backup services like ConnectWise Cloud Backup normally hold read access to mail, files, Teams, and directory data so it can copy them and restore them.

“The larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies,” Huntress added. 

“Each of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough.”

They noted that in managed service providers the effect can be even worse — with attackers using their foothold in one customer to gain access to all other customers. 

ConnectWise has dealt with multiple security incidents in the past, including one last year involving a nation-state attack on its remote management and monitoring software that impacted some of its customers.

Cybercriminals previously exploited multiple vulnerabilities in the company’s products that led to ransomware attacks.