ConnectWise Suspends Cloud Backup After M365 Tenant Compromise

On Saturday, ConnectWise announced that it had disabled seven of its application identities as part of an investigation into a breach where unknown threat actors obtained unauthorized access to Microsoft 365 tenants and compromised those identities. The affected identity is listed below: - ConnectWise Cloud Backup – 506e08f9‑6e9a‑4da4‑942b‑a099a03644ae (ConnectWise) ¹

Experts say the attackers likely leveraged stolen OAuth tokens or API keys—common targets for managed service provider attacks—to impersonate legitimate users and gain administrative privileges within targeted M365 environments. This vector mirrors earlier high-profile incidents such as the Kaseya ransomware attack in July 2021 when a compromised VPN credential allowed infiltration across multiple MSP networks; however this event appears more focused on cloud backup solutions due to its emphasis on application identities rather than broader system compromise across multiple platforms and vendors simultaneously, as seen with Kaseya’s case at that time.

While disabling these identities mitigates immediate risk, experts note it does not prevent lateral movement if other vulnerabilities exist elsewhere inside customer environments. A full audit should be performed before re-enabling services under any circumstance whatsoever given known threat actor persistence behavior patterns observed previously during similar incidents worldwide among various industries facing increasing cyber threats today, especially those involving supply chain compromises like these ones we see happening now frequently enough already even without considering emerging trends either!

The “application identities” are essentially service accounts with elevated permissions. Restricting their use is standard procedure here but means some automated processes will stop working until they can be secured again. Expect MSPs using ConnectWise's services to implement multi‑factor authentication immediately for all accounts accessing sensitive systems—a best practice often overlooked despite its effectiveness in preventing credential compromise. The incident underscores how stolen credentials can enable attackers to impersonate legitimate users and gain administrative privileges within targeted Microsoft 365 tenants, potentially facilitating data exfiltration or ransomware deployment based on current reporting ¹.

Organizations must remain vigilant by conducting comprehensive audits of privileged accounts, enforcing strict MFA controls, and monitoring tenant activity.