Analysis
ConnectWise suspended its Cloud Backup service and the SaaS Security and Cloud Management tools integrated with it after detecting "unauthorized access to application identities" within the Cloud Backup environment, the company disclosed on October 16, The Register reported. The intrusion was first detected October 15.
ConnectWise sells SaaS tools to managed service providers, including the ERP and Cloud Backup (formerly SkyKick) products that back up data across on-premises systems, the cloud, and SaaS platforms like Microsoft 365 and Google Workspace. As of 4 p.m. UTC on October 18, the services remained unavailable, leaving customers unable to back up data, access archives, or restore files.
A supply-chain problem, not just an outage
Security firm Huntress found that attackers compromised a Microsoft 365 API secret belonging to Cloud Backup and are using it to access customers' M365 environments directly. In at least one partner's tenant, the ConnectWise Cloud Management-Teams app granted itself Global Administrator access and added credentials to two other applications. Huntress warns that simply disabling the compromised apps won't remove credentials attackers already added, meaning every affected MSP needs to audit its own M365 app permissions regardless of what ConnectWise fixes on its end.
ConnectWise says existing backup archives remain encrypted, isolated and show no evidence of unauthorized access, and that the service suspension doesn't mean any MSP or its customers were actually compromised -- it says it simply isn't confident the services can run safely right now. But because MSPs aren't required to disclose which backend vendors they use, many end customers have no idea ConnectWise sits in their supply chain at all, a dynamic security researchers have compared to the 2021 Kaseya attack.
ConnectWise hasn't disclosed how many customers are affected or offered a restoration timeline, and VP of security operations Jason Ferguson said the company "cannot discuss threat actor attribution at this time" while forensic analysis, threat hunting and remediation continue.
