Hackers Use Compromised ConnectWise Credential to Access 173 Microsoft 365 Tenants

An unknown threat actor used a compromised ConnectWise Cloud Backup credential to authenticate to 173 Microsoft 365 tenants, gaining broad access to email, files, and directory data.

An unknown threat actor used a compromised ConnectWise Cloud Backup credential to authenticate to 173 Microsoft 365 tenants on Oct. 15, security firm Huntress reported.

The attacker, operating from IP address 144.172.64.128, traversed tenants in sorted GUID order a few seconds apart, which indicates a scripted approach.

ConnectWise Cloud Backup is a cloud-based backup and recovery service for managed service providers. The application requires broad permissions to access mailboxes, OneDrive, SharePoint, Teams, and directory data in each tenant where it is installed.

Huntress observed the same IP address attempting password spraying against four law firm tenants on Oct. 13 and 14, but detected no successful user sign-ins.

In at least one partner tenant, the attacker used the compromised app to assign itself Global Administrator privileges and added credentials to other trusted applications.

The ConnectWise Cloud Management app for Teams (application ID 24205314-2b89-4e07-a2a4-579e898a5640) added itself to the Global Administrator role, then ran a Python script that modified two other applications: an MSP management application and the Huntress Security Platform application, adding new client secrets to both.

Adding a credential to an MSP management application can extend access beyond a single tenant, because those applications are consented into multiple customer tenants.

A credential on a security tool's application gives the holder whatever that tool is permitted to do.

Todyl , a security company, detected unauthorized access to Microsoft Graph as the ConnectWise Cloud Backup application. The access inherited the app's existing consent, which permits read/write access to mail and attachments, OneDrive and SharePoint files, and Teams chats.

Revoking user sessions does not end this access. Disabling the app in a tenant stops new tokens from being issued, but tokens that were issued before the app is disabled remain valid for up to 90 minutes.

Any tenant where the app is enabled stays exposed until ConnectWise rotates the credential.

ConnectWise has disabled the Cloud Backup application and stated it has found no evidence that partner backup data was compromised.

The company provided indicators of compromise. In the Microsoft Entra Admin Center , navigate to Monitoring → Sign-in logs, select the Service principal sign-ins tab, and filter by application ID 506e08f9-6e9a-4da4-942b-a099a03644ae. Review the IP address column for authentication from unexpected addresses. The application's normal egress is Azure private IPv6. The suspicious IP address is 144.172.64.128.

Huntress recommends disabling the application until ConnectWise confirms all credentials have been reset, enabling Microsoft Graph activity logs, auditing for any new credentials added since Oct. 13, and checking Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role.

The incident highlights the risk of broad permissions granted to backup services. An attacker with the app's credentials inherits that level of access for every tenant where the app is installed.

In a separate development, Google's Mandiant and Google Threat Intelligence Group, along with ManageEngine Threat Analysis Lab, detailed an ephemeral supply chain tampering of the AOMEI Backupper update infrastructure. The threat actor modified update settings files on origin servers for five- to ten-minute windows, redirecting users to download a malicious ZIP package containing CROSSROAD and SHINYROAD malware. The campaign, attributed to UNC7017, affected organizations across multiple sectors and countries.

Source : thehackernews.com