The company confirmed on October 18 that scheduled backups remained suspended, restoration facilities were unavailable and additional cloud management services had been temporarily taken offline while investigators examined the security breach.
ConnectWise said it disabled seven application identities at 07:00 UTC on October 17 and revoked certificates associated with affected connections. The measures invalidated compromised shared credentials, although previously issued access tokens could remain operational until expiry.
Cybersecurity company Huntress initially confirmed unauthorised application sign-ins across 162 Microsoft 365 tenants as of 19:00 UTC on October 16. Its investigators subsequently identified 173 affected partner and customer tenants, indicating a broader intrusion than first established.
Jonathan Semon, a security researcher at Huntress, identified suspicious authentication activity originating from IP address 144.172.64.128 between 06:13 and 08:34 UTC on October 15. Attackers obtained Microsoft Graph access tokens using credentials associated with ConnectWise Cloud Backup, formerly SkyKick.
The compromised application normally receives extensive permissions to access customer mailboxes, OneDrive storage, SharePoint documents, Teams information and directory records. Attackers possessing its credentials could consequently authenticate using permissions already granted by customer organisations.
Investigators found that the intruders moved systematically between tenant environments, with authentication attempts occurring seconds apart. The pattern suggested automated activity using a prepared list of customer identifiers rather than isolated attempts against individual accounts.
ConnectWise said its investigation had found no evidence that encrypted backup archives were accessed. Existing archives remained isolated and preserved, although customers could neither retrieve stored backups nor restore information while protective restrictions remained active.
The company emphasised that its assessment of backup archives did not establish whether information inside individual Microsoft 365 customer environments had been accessed or extracted. Its systems lack sufficient visibility into downstream customer tenants to determine their security status independently.
The October 18 advisory also confirmed that SaaS Security and Cloud Management had been temporarily suspended. Monitoring and alerting functions, alongside certain user and licence management operations, were unavailable during the investigation.
ConnectWise said its security operations centre was working with an independent forensic investigation firm to examine affected infrastructure and assess possible exposure across other partner-facing services.
The company reported no successful malicious activity within environments it monitored after containment measures were implemented. Nevertheless, it cautioned that disabling compromised applications would not automatically reverse unauthorised changes already made inside customer environments.
Huntress investigators identified additional suspicious activity involving ConnectWise Cloud Management applications associated with Exchange Online, Microsoft Teams and SharePoint Online.
One investigation uncovered an application assigning itself Global Administrator privileges and adding credentials to other applications. Such changes could provide attackers with continuing access independently of the original compromised backup identity.
Security specialists therefore warned that revoking the initial vendor credentials might not eliminate every potential access route. Customer administrators were advised to examine newly created application secrets, privileged role assignments, consent permissions and unexplained directory modifications.
ConnectWise instructed managed service providers to review their own Microsoft 365 environments and every customer tenant under their administration, including organisations retaining dormant SkyKick connections.
Administrators were directed to examine Microsoft Entra service-principal sign-in records, particularly authentication associated with the compromised applications and the identified suspicious address.
The company recommended preserving authentication and audit records before retention periods expired, while ensuring evidence collection did not delay urgent containment measures.
Investigators were also advised to examine mailbox forwarding configurations, inbox rules, delegated access permissions and changes to application ownership or security policies.
ConnectWise cautioned that suspicious authentication alone did not establish that customer information had been copied. Equally, the absence of visible malicious activity could not conclusively exclude operations missing from available audit records.
The company identified the security issue on October 14 and published its initial advisory on October 16. It has not established how the application credentials were originally exposed or whether a software vulnerability contributed to the incident.
No restoration timetable had been announced by October 18. ConnectWise said reconnection instructions would follow completion of critical investigative and validation work.
During the interruption, newly created or modified Microsoft 365 information may remain outside existing backup recovery points because scheduled protection jobs are not operating.
ConnectWise has asked affected partners to preserve relevant evidence and report suspicious findings through its dedicated security support channel, including application identifiers, timestamps and details of unauthorised activity.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
