IT management software provider ConnectWise has suspended access to several of its cloud services after it discovered that unauthorized actors had gained access to Microsoft 365 tenants.

A Microsoft 365 tenant is a dedicated instance of Microsoft services used by an organization to store their data separately from other organizations using Microsoft services. Each organization using a Microsoft 365 tenant has its own unique identifier assigned to it by Microsoft.

ConnectWise began investigating suspicious activity on October 15. By October 17, the company said that it had identified “unauthorized access to application identities within the ConnectWise Cloud Backup environment.”

The discovery has resulted in several ConnectWise cloud services including Cloud Backup (previously known as SkyKick), SaaS Security and Cloud Management being taken offline while the company investigates the incident, said a security advisory.

“We understand that this interruption affects your ability to support your customers. We do not yet have a confirmed restoration time and will share a timeline as soon as we can do so reliably,” ConnectWise said in an October 19 update.

The action has been taken due to the discovery of unauthorized access to application identities associated with ConnectWise Cloud Backup.

An attacker could potentially abuse this access to gain unauthorized access to customers' Microsoft 365 environments. They would do this by authenticating to the app using the tooling of the tenant in the same way the backup service would, leveraging this access to obtain tokens with the app's existing permissions, therefore providing access to the environment.

With this access an attacker could access the same directories and data as a backup service, putting the tenant users’ corporate data at risk.

“The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Multi-factor authentication (MFA) doesn’t apply because this is an application sign-in, so no user, device, or MFA prompt is involved,” said Justin Kohler, chief product officer at SpecterOps

“Backup tools need broad access to read and restore data. Anyone holding the app’s credential can reach the same mailboxes, OneDrive and SharePoint files, Teams data, and directory information the backup service can,” he added.

Cybersecurity analysts at Huntress have been following the ConnectWise incident. In a blog post, they said that in at least one customer tenant being observed, the attacker provided themselves with a Global Administrator role, using this access in an attempt to modify permissions for other applications, including an MSP management application, and Huntress's own security application.

While ConnectWise has said it has yet to discover any indication date that partner backup data has been compromised, the company said it will “continue investigating potential unauthorized access.”

There is currently no attribution as to who could be behind the attack. “We cannot discuss threat actor attribution at this time. Our focus is on investigation, remediation, and supporting affected partners and their customers,” ConnectWise said in the advisory.

ConnectWise has also advised its customers to take the following actions to help identify any potential incidents:

• Verify the status of the listed application connections and keep affected applications disabled until ConnectWise provides restoration instructions
• Preserve available sign-in and audit records promptly, while taking any urgent containment action
• Review application and user authentication, application credentials and federation trusts, directory roles, owners, consent grants and recent policy changes
• Check for unauthorized mailbox forwarding, inbox or transport rules and delegated mailbox access
• Investigate any other identities changed or used during suspicious activity; disabling the original applications does not remove those separate access paths