Hackers Abuse Compromised ConnectWise Credential to Access 173 M365 Tenants
Attackers use stolen ConnectWise Cloud Backup credentials to access 173 Microsoft 365 tenants affecting multiple managed service providers.
Why it matters
Compromise of third-party credentials poses a significant threat to managed service providers and their customers by expanding attacker access across multiple environments.
SOC impact
Investigate authentication logs related to ConnectWise Cloud Backup access across Microsoft 365 tenants. Confirm which tenants and accounts have been accessed using compromised credentials and monitor for unusual activity tied to these accounts.
Recommended actions
- Identify Microsoft 365 tenants connected to ConnectWise Cloud Backup accounts
- Review logs for unusual or unauthorized access using ConnectWise credentials
- Monitor privilege use and administrator actions within affected tenants
- Correlate access events with threat intelligence on compromised credential usage
- Assess integration points between MSPs and Microsoft 365 environments
Executive Summary
Unknown threat actors have leveraged compromised credentials belonging to ConnectWise Cloud Backup to infiltrate 173 Microsoft 365 tenants. This campaign targets managed service providers who use ConnectWise services, allowing attackers to gain unauthorized access across multiple customer environments. The compromise of third-party software credentials demonstrates a systemic risk to Microsoft 365 tenants that rely on such integrations. Operationally, this requires focused validation of authentication events associated with ConnectWise and heightened scrutiny of access patterns within affected tenants. Early detection and containment depend on understanding the scope of credential misuse across MSP-managed environments.
SOC Impact
Investigate authentication logs related to ConnectWise Cloud Backup access across Microsoft 365 tenants. Confirm which tenants and accounts have been accessed using compromised credentials and monitor for unusual activity tied to these accounts.
Authentication and Access Validation
- Identify Microsoft 365 tenants connected to ConnectWise Cloud Backup accounts
- Review logs for unusual or unauthorized access using ConnectWise credentials
- Monitor privilege use and administrator actions within affected tenants
- Correlate access events with threat intelligence on compromised credential usage
- Assess integration points between MSPs and Microsoft 365 environments
Why It Matters
Compromise of third-party credentials poses a significant threat to managed service providers and their customers by expanding attacker access across multiple environments.