ConnectWise Pauses Cloud Backup After Seven M365 App Identities Misused

En bref

• An unidentified intruder reached Microsoft 365 tenants through seven application identities linked to ConnectWise Cloud Backup.
• ConnectWise turned off those identities and paused the backup service on Saturday.
• The company says its review is ongoing; scope and any data exposure are not yet confirmed.
• K-12 districts should inspect Microsoft 365 app registrations, consent grants, and backup access paths.

ConnectWise took its Cloud Backup service offline on Saturday after discovering that seven application identities had been used to reach Microsoft 365 tenants without authorization. The company disabled those identities and paused the backup product while its review continues. The party behind the activity has not been identified.

The immediate exposure centers on organizations that rely on ConnectWise Cloud Backup to protect Microsoft 365 data, a group that can include school districts and other public-sector users. Although seven identities is a small number, application identities often carry broad permissions and can serve as a high-value path into mail, files, and directory data. A compromised tenant can expose sensitive communications and records, and the backup suspension may also affect recovery options until service is restored.

This does not appear to be tied to a newly disclosed software vulnerability; no CVE was cited. That shifts attention to identity governance, consent, and monitoring rather than patch management. For K-12 IT teams, the incident is a reminder that third-party backup and productivity integrations need the same scrutiny as user accounts, especially when they hold persistent access to Microsoft 365.

What to watch: official notices from ConnectWise about service restoration and indicators of compromise, tenant audit logs showing unusual application activity, and any guidance from Microsoft about affected app registrations. Districts should also confirm whether their backup coverage has a fallback if the service remains unavailable. The severity is medium: limited identity count, but potentially serious tenant-level access and backup disruption.

À faire maintenant

1. Inventory Microsoft Entra ID app registrations and enterprise applications tied to ConnectWise Cloud Backup; record their IDs, owners, permissions, and consent grants.
2. Disable or revoke consent for those application identities if they are not essential, and rotate any associated secrets or certificates.
3. Review Microsoft 365 unified audit logs and sign-in logs around Saturday for anomalous application access, new consent grants, mailbox rule changes, and file downloads.
4. Pause reliance on the affected backup service until ConnectWise confirms restoration, and validate that independent backups or retention controls are available.
5. Apply least privilege to all third-party applications, restrict high-risk Graph permissions, and require approval for new consent grants.
6. Preserve relevant logs and contact ConnectWise support for incident indicators; escalate to district leadership and the security team if suspicious tenant activity is found.

Source originale

The Hacker News