Security researchers at Huntress found that attackers have gained access to a credential used by ConnectWise Cloud Backup, a service that is used to back up customers’ Microsoft 365 data.

They have confirmed that it is being used to gain unauthorized access to customers’ Microsoft 365 environments belonging to 173 partner and customer organizations. They also found that attackers tried to gain administrator privileges and added new credentials to maintain access.

Through the blog, we will understand what the threat is about, its impact on organizations, and what they can do to defend against it.

About the threat

How does the threat impact organizations?

A successful compromise may allow threat actors to:

• Access Microsoft 365 mailboxes, emails, and attachments.
• Access OneDrive, SharePoint, and Teams data, depending on permissions.
• Enumerate users, groups, and directory information.
• Escalate privileges through unauthorized directory role assignments.
• Add application credentials to maintain persistent access.
• Abuse trusted MSP integrations to access additional customer environments.
• Expose sensitive organizational and customer data.

Official security guidance

Organizations should:

• Identify ConnectWise Cloud Backup applications and related service principals.
• Review Microsoft Graph permissions and OAuth consent grants.
• Disable affected application identities in coordination with ConnectWise.
• Remove unauthorized client secrets and certificates.
• Investigate unexpected Global Administrator assignments.
• Review Microsoft Entra ID service principal sign-in and audit logs.
• Investigate Exchange, SharePoint, OneDrive, and Teams activity.
• Revoke suspicious access and tokens using appropriate Microsoft procedures.
• Preserve logs and follow official vendor remediation guidance.

SharkStriker’s recommendations

As an MSSP, SharkStriker recommends:

• Identify affected applications: Inventory ConnectWise integrations across Microsoft 365 tenants.
• Review permissions: Identify excessive application permissions and unauthorized consent grants.
• Hunt for suspicious activity: Investigate unusual service principal sign-ins, source IPs, and Microsoft Graph access.
• Check persistence: Review new client secrets, certificates, and privileged role assignments.
• Investigate data access: Examine mailbox, file-sharing and Teams audit logs for suspicious activity.
• Coordinate remediation: Work with ConnectWise and the relevant service provider before disabling business-critical integrations.     
• Strengthen security: Apply least-privilege access and continuously monitor third-party application identities.