Microsoft warns over “active supply chain attack” as ConnectWise 0Auth app compromised

"Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants..."

An unknown threat group is attacking thousands of Microsoft 365 tenants after gaining access to what Redmond describes as “the trusted OAuth App of the backup application ConnectWise Cloud Backup” – which has suspended multiple services.

It remains unclear how they gained that initial access, and how deep a potential compromise at ConnectWise itself might be. The company is still investigating.

ConnectWise has suspended cloud backups, pausing scheduled backups and freezing restoration capabilities after the supply chain incident. On October 18 it confirmed that it has also taken its SaaS Security and Cloud Management services offline too.

Security firm Huntress Labs said that it has seen over 1,000 Entra (Microsoft’s identity and access management) tenants targeted, over 300 successfully. On one system it had visibility into, a maliciously controlled ConnectWise Cloud Management app for Microsoft Teams gave itself the Global Administrator role at one customer, then ran a Python script that modified an MSP management app, and Huntress's own app.

This content is for members only

Already have an account? Sign in

Edward Targett Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.