Quick Takeaways
- Attackers used vendor credentials from 144.172.64[.]128 to access ConnectWise application identities.
- In two tenants, a compromised app granted itself Global Administrator and planted secrets in other apps for persistence.
- A separate broad password spray was observed from 144.172.94[.]243; no mailbox/file manipulation or user/policy changes were seen.
Threat, Techniques, and Targets
- ConnectWise reported unauthorized access to application identities linked to Cloud Backup. Huntress identified
144.172.64[.]128as the primary source of application sign ins using a vendor credential. - In two reviewed tenants, an application granted itself Global Administrator access. It then added a secret to other applications, which could support persistence. The activity may also have enabled Microsoft Graph directory reads.
- Huntress observed password spraying and failed logins from other listed IP addresses. However, it said those attempts likely did not relate to the application sign ins.
- The activity affected Microsoft 365 tenants linked to ConnectWise applications. ConnectWise said each partner and customer should review its own tenant.
Impact, Security Implications, and Remediation
- ConnectWise suspended Cloud Backup and, as a precaution, SaaS Security and Cloud Management. The company said it has seen no successful threat activity in the environments it monitors. It reported no evidence that other products or services faced impact.
- Huntress found no signs that attackers changed mailboxes, files, users, or policies. However, each tenant review remains important because the available findings do not establish whether a specific tenant faced impact.
- ConnectWise disabled affected application connections, reset accounts, replaced application credentials, and strengthened administrative access protections. It also engaged independent incident response specialists and published guidance for partners.
- Before making changes, preserve relevant evidence, validate findings, and assess operational impacts. These steps do not guarantee that a tenant has no impact or that all unauthorized access has ended.
- Do not reconnect affected applications until ConnectWise provides formal restoration instructions. For further remediation guidance, consult ConnectWise’s technical guidance and updates.
Expand Your Tech Knowledge
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
