ConnectWise suspends Cloud Backup service after supply chain attack - The Record from Recorded Future News
This story deserves to be shared
Send it to someone who'd care, or post it on your networks.
IT management software company ConnectWise shut down several of its services this weekend after Microsoft and other cybersecurity companies warned of a supply chain attack impacting its cloud backup system. ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday. Incident responders at cybersecurity firm Huntress said a credential belonging to ConnectWise Cloud Backup was compromised and used to gain access to the customers’ Microsoft 365 environment. Microsoft confirmed in its own statement that threat actors “likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory. ReadWrite. All.” ConnectWise Cloud Backup is a cloud-based backup and recovery service designed to help protect data in Microsoft 365 and Google Workspace. The tool needs broad access to mailboxes, OneDrive, SharePoint, Teams and other data, according to Huntress.
This article is an excerpt. To read the full content, visit the original source. The Record from Recorded Future News
Related articles
ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users - Cybersecurity Dive
Managed service providers said an attacker used compromised credentials to gain access to tenants. ConnectWise headquarters in Tampa, Florida. The company suspended service to its Cloud Backup service after a supply chain attack using compromised credentials.
Cybersecurity jobs report, ConnectWise suspends cloud backup, Drupal patches flaws - LinkedIn
Cybersecurity jobs report reveals mixed bag Published by workforce intelligence company
ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU - The Register
Huntress alleges takeover of M365 accounts SaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access. ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments. Cloud Backup is one of those tools and does what it says on the tin for data stored on-prem, in the cloud, or in SaaS services like M365 and Google Workspace. On October 16, the company published an advisory revealing that on the 15th it “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.”
WARNING: ConnectWise Supply-Chain Attack Exposes Microsoft 365 Tenants - LinkedIn
A supply-chain attack involving ConnectWise’s cloud services has exposed Microsoft 365 customers to unauthorized application access, with researchers reporting successful sign-ins across 173 partner and customer tenants. The incident centres on credentials associated with ConnectWise Cloud Backup, formerly SkyKick, and raises concerns about attackers exploiting permissions already entrusted to business software. ConnectWise has confirmed unauthorized access to application identities within its Cloud Backup environment. In an October 17 update on its service-status page, the company said it was shutting off application access, interrupting customer backups while investigation and remediation continued.
ConnectWise CTO On Cloud Backup Cyberattack, M365 Update And Helping Thousands Of Partners - CRN
‘We are running as fast as we possibly can, while maintaining that we don’t create shortcuts for ourselves in order to rush things to market, to make sure the service is safe, secure, the environment is clean, and we will bring it back online,’ ConnectWise CTO David Raissipour tells CRN. ConnectWise’s David Raissipour says his company is doing everything possible to help thousands of ConnectWise partners affected by the recent attack on its Cloud Backup product, with no suspicious activity witnessed in more than 24 hours.
0 comments
No comments yet. Be the first to share your thoughts!