Supply-Chain Attack on ConnectWise Cloud Backup

A threat actor obtained a credential (API secret) belonging to ConnectWise Cloud Backup, and ConnectWise has confirmed that it is being used to gain unauthorized access to customers’ Microsoft 365 environments. The speed with which the threat actor gained initial access across the affected organizations suggests that this part of the attack was automated.

In one case, the threat actor not only accessed the victim organization’s environment but also granted itself the Global Administrator role and added new credentials to two other applications in the tenant, ensuring additional persistence. [1]

Recommended Actions

The blast radius of a large supply-chain attack like this may be considerable. ConnectWise Cloud Backup is officially marketed as a backup solution for MSPs, which means that if a threat actor breaches an MSP, the MSP’s customers may subsequently be compromised in further supply-chain attacks.

Nothing is known yet about the threat actor behind the attack. However, the fact that additional persistence was established in only one of the 173 identified victims suggests that the actor may have a relatively narrow primary target list, which is consistent with the modus operandi of an espionage actor.

For ConnectWise Cloud Backup Users
ConnectWise has reportedly taken its cloud backup service offline. Any organization using ConnectWise Cloud Backup should disable the service in its systems until ConnectWise has reset all credentials and confirmed that the service is safe to use again. Immediate victims that use ConnectWise Cloud Backup should also conduct threat hunting for the IOCs listed below. More details on how to protect your environment are available in a Microsoft blog post. [2]

For Organizations that Worry About Potential Supply-Chain Attack
Organizations concerned about a potential supply-chain attack should contact their service provider to discuss the risk that an MSP compromise related to this breach could lead to cascading attacks against them.

Indicators of Compromise (IOCs)

The following IOCs were observed when the threat actor connected to victims’ Microsoft 365 environments. Truesec is already conducting threat hunting for this activity in customer environments protected by Truesec.

Observed indicators include

144.172.64[.]128	Origin of suspicious activity
144.172.64[.]99	Origin of suspicious activity
144.172.64[.]60	Origin of suspicious activity
Python-urllib/3.12	User agents in the suspicious authentication activity*
python-requests/2.31	User agents in the suspicious authentication activity*
curl/7.88.1	User-agent in password spray*

Note that these user-agents can occur in legitimate traffic too.

Please reach out to your Truesec if you have any questions regarding this activity.

References

[1] https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
[2] https://windowsforum.com/news/connectwise-cloud-backup-breach-disable-skykick-apps-and-hunt-microsoft-entra-backdoors.448897/