ConnectWise Cloud Backup Accessed by Unidentified Intruders, Prompting Credential Response

En bref

• Unidentified attackers accessed ConnectWise Cloud Backup, and the service was taken offline.
• The incident involves identities used by applications, raising concern about exposed credentials.
• Response actions include resetting credentials, replacing accounts, and tightening admin access.
• No CVE was cited; severity is assessed as medium.

ConnectWise's Cloud Backup service was accessed by parties that have not been identified, according to the facts available. The event was reported on Monday and left the backup offering unavailable. Because backups are a recovery lifeline, even a temporary outage draws attention from IT and security teams.

The scope described is not end-user mailboxes or general staff accounts but identities that applications use to authenticate and operate. That distinction matters: app identities often carry broad permissions and are less frequently rotated. If those secrets were exposed, attackers could potentially reuse them elsewhere, so the risk extends beyond the backup product itself.

Responders have moved to reset credentials, swap out affected accounts, and strengthen administrative access controls while incident handling continues. These are sensible containment steps, but they also signal that the organization is treating the event as more than a routine service disruption.

For K-12 and government environments, backup platforms are high-value because they support continuity and recovery after ransomware or other disruptions. An outage combined with possible credential exposure can complicate both restoration and trust in the backup chain. The absence of a CVE means this is not a known software flaw being tracked publicly; the focus is on access and identity hygiene.

What to watch: confirmation of the number and type of app identities involved, whether any credentials were actually misused, and when the service is fully restored. Administrators should verify logs, rotate secrets, and review admin roles before restoring normal operations.

À faire maintenant

1. Reset credentials for all application identities tied to ConnectWise Cloud Backup, prioritizing accounts with administrative or broad backup permissions.
2. Replace affected accounts rather than only changing passwords where feasible, and remove stale or unused app identities.
3. Review and tighten administrative access: enforce least privilege, require MFA for admin consoles, and limit who can alter backup configurations.
4. Preserve logs and evidence from Monday onward; check authentication and backup job records for unusual access or configuration changes.
5. Confirm backup integrity and test restoration from an isolated environment before trusting the service again.
6. Notify stakeholders and follow incident response runbooks; coordinate with ConnectWise support for scope and remediation details.
7. Audit other integrations that share credentials or trust with the backup platform and rotate those secrets as a precaution.

Source originale

The Hacker News