Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

What happened

Huntress said it has observed confirmed unauthorized sign-ins within 173 partner/customer tenants using the compromised vendor credential. "It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC. The actor moved through tenants in sorted GUID order, a few seconds apart, which points to a script working from a target list." Microsoft is a software and software development company based in Redmond.

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) to secure their clients' Microsoft 365 or Google Workspace data.

To accomplish its tasks, the application is granted broad access to mailboxes, OneDrive, SharePoint (Stack Exchange site for SharePoint enthusiasts), Teams, and directory data in every tenant on which it's installed. The incident impacts every organization that has the app installed, and the credential works against every tenant the app is consented in. "The app's credential is in hostile hands," security researcher Jonathan Semon said .