The software company confirmed on Monday that Cloud Backup, SaaS Security and Cloud Management remained suspended while investigators assessed the intrusion and tested measures intended to prevent further unauthorised access. It has not announced when the services will resume.
The interruption prevents scheduled backups, access to stored archives and data restoration through Cloud Backup, formerly known as SkyKick. SaaS Security monitoring and alerts are unavailable, while Cloud Management users cannot perform normal user and licence administration through the affected platform.
ConnectWise said its existing backup archives remained encrypted and isolated, with no indication that attackers had accessed those stored records. That assurance does not establish whether individual customers’ live Microsoft 365 environments escaped compromise.
The company disabled seven application identities on 17 October and revoked certificates associated with affected Cloud Backup connections. It warned that invalidating shared credentials stops fresh authentication through those connections but cannot undo changes attackers might already have made inside customer accounts.
Previously issued access tokens could also remain functional until they expire or are separately invalidated, creating a distinction between shutting down the compromised entry point and establishing that every affected customer environment is secure.
Cybersecurity company Huntress identified suspicious authentication activity involving a ConnectWise Cloud Backup credential across Microsoft 365 tenants. Its investigation found the application identity signing into 162 tenants between 15 and 16 October, although authentication records alone do not demonstrate that information was stolen from each organisation.
Huntress also identified activity from an attacker-associated internet address across a much larger collection of Microsoft Entra tenants. Some authentication attempts succeeded, but the researchers cautioned that successful authentication did not necessarily provide access where the relevant ConnectWise application identity was absent.
The investigation separately uncovered an episode in which a ConnectWise Cloud Management application obtained Global Administrator privileges within one customer tenant. Additional credentials were subsequently added to applications, potentially allowing continued access without relying on the original compromised secret.
Huntress has not established that all the observed activity was conducted by the same attacker. The distinction matters because investigators are examining both misuse of a vendor-controlled credential and potentially separate changes to permissions within customer environments.
ConnectWise said its response teams were working alongside outside specialists on containment, remediation and service validation. The company stated that it had not observed successful malicious activity in the environments it monitored after implementing its protective measures.
That observation covers monitored environments rather than every organisation using the affected products. ConnectWise has urged managed service providers and their customers to conduct their own reviews of Microsoft 365 accounts, application permissions and authentication histories.
Its technical guidance calls for examining Microsoft Entra service-principal sign-in records, including activity associated with the Cloud Backup application. Administrators are advised to investigate unfamiliar addresses, unexpected administrative privileges and newly created application credentials.
Security teams have also been asked to examine changes to application consent, federation settings, access policies and mailbox configurations. Such alterations could allow an intruder to retain privileges even after the original credential has been revoked.
ConnectWise identified 144.172.64.128 as a suspicious internet address associated with the incident. It cautioned that an indicator appearing in logs warrants investigation but does not independently prove a particular customer environment was compromised.
The disruption has consequences for managed service providers responsible for protecting multiple organisations’ Microsoft 365 information. With restoration functions unavailable, affected providers cannot rely on the suspended platform to retrieve archived material while the investigation continues.
The company has contacted its partner network and directed customers to its Trust Center for technical instructions and service updates. It has also asked partners to coordinate checks with their security teams and report suspicious activity through its dedicated security support channel.
ConnectWise first acknowledged attempts at unauthorised access on 16 October. Its subsequent containment actions extended beyond the backup product because the security and management services share integrations with the affected cloud environment.
The company’s status notices identify the incident as affecting services across all regions. Engineering and operations personnel are continuing restoration checks, while specialists review affected application connections, with no confirmed timetable for returning scheduled backups, archive retrieval, security alerts or cloud administration functions to normal operation.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
