Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Overview
Cybersecurity researchers have identified an ongoing campaign where hackers are using compromised Microsoft 365 credentials from ConnectWise Cloud Backup to access the M365 environments of 173 customers. ConnectWise Cloud Backup, previously known as SkyKick, is a service designed for managed service providers to offer cloud-based backup solutions. The attackers are exploiting these stolen credentials to gain unauthorized entry, which poses a significant risk to the affected organizations. This incident not only compromises sensitive data but also raises concerns about the security protocols in place for cloud services used by MSPs. Companies relying on these services should review their security practices and monitor for any unusual activity in their accounts.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Microsoft 365, ConnectWise Cloud Backup
- Action Required: Organizations should immediately review and reset any compromised credentials, enforce multi-factor authentication, and monitor for suspicious activity in their Microsoft 365 accounts.
- Timeline: Newly disclosed
Original Article Summary
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs
Impact
Microsoft 365, ConnectWise Cloud Backup
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Organizations should immediately review and reset any compromised credentials, enforce multi-factor authentication, and monitor for suspicious activity in their Microsoft 365 accounts.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Microsoft.