SaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access. ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments. Cloud Backup is one of those tools and does what it says on the tin for data stored on-prem, in the cloud, or in SaaS services like M365 and Google Workspace. On October 16, the company published an advisory revealing that on the 15th it “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.” “The service interruption affects partners and customers using Cloud Backup, formerly known as SkyKick. Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services have also been suspended out of an abundance of caution while our investigation and remediation continue,” the company advised. The suspension does not mean MSPs, or their customers, should assume that their environments were compromised, just that ConnectWise isn’t confident it can operate its services safely at this time. As of 16:00 UTC on October 18, the services remain unavailable, which means end-users can’t back up data, access their archives, or restore data. “Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities,” the company’s veep of security operations, Jason Ferguson, wrote on Reddit. ConnectWise has not offered much detail on the incident, other than to publish some indicators of compromise it thinks are tied to a handful of IP addresses and integrations with third-party apps. It has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products. Security outfit Huntress offered a starker view and wrote “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments.” “In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner.” “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added,” the firm warns. “You must review the credentials on all of your M365 applications.” ConnectWise says it “cannot discuss threat actor attribution at this time” because it is focused on “investigation, remediation, and supporting affected partners and their customers.” It has, however, called on its customers to probe any M365 environments they manage for signs of compromise. This is where things get tricky, because ConnectWise has no knowledge of those setups – as is proper because it is a platform provider and its MSP clients manage end-user relationships. It’s therefore relying on MSPs to do the right thing. MSPs are under no obligation to disclose the platforms they use to deliver their services. Indeed, for some organizations the allure of working with an MSP is to access packaged services they never need to learn or worry about. End-user organizations that may be happily oblivious about ConnectWise’s contribution to their business are therefore in an awkward position. Businesses that serve MSPs are a frequent target for attackers, who see the chance to compromise the likes of ConnectWise as a possible route to crack all of their partners and those service providers' end-users. The 2021 attack on Kaseya is the most notorious example of such an incident. ConnectWise will be hoping it doesn't take the crown. ®
