Hackers Breach Microsoft 365 Tenants via ConnectWise Supply-Chain Attack

Over 170 Microsoft 365 Tenants Breached via ConnectWise Service Principal Exploit

ConnectWise suspended its Cloud Backup service after a supply-chain attack allowed unauthorized access to 173 Microsoft 365 tenants by bypassing MFA via Service Principals.

Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.

Microsoft Entra and a stolen app credential attack

Merill Fernando explains how one stolen app secret let an attacker sign in to 173-plus Microsoft 365 tenants without phishing or MFA. The video says an attacker signed in to more than 170 Microsoft 365 tenants.No phishing, password, or MFA prompt was needed in the reported access.The app named ConnectWise Cloud Backup was used as a multitenant identity.Merill lists tenant checks: app ID, sign-in logs, audit logs, and log export.The incident…

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise to shut off application access and interrupt backup services. Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16, exposing risks associated with privileged vendor applications. ConnectWise said in its October 17 update, supplied for this report, that investigators iden…

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker - National Cyber Security Consulting

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs) […] Thank you for subscribing to our RSS feed!

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs