CONNECTWISE has disclosed remediation steps following a security incident that granted unauthorized access to Cloud Backup application identities. The company stated that it disabled affected application connections and suspended Cloud Backup, with precautionary suspensions of SaaS Security and Cloud Management due to their integration with Cloud Backup.
It has also engaged independent third-party incident responders and increased administrative-access protections, while publishing guidance to help partners investigate and remediate potential unauthorized activity in their environments. ConnectWise notes that no evidence has emerged of successful threat activity in its monitored environments, and that other products and services appear unaffected aside from Cloud Backup and the suspended services.
Investigations and indicators of compromise were supplemented by external researchers. Huntress reported several IP addresses observed in activity linked to the event, including 144.172.64.[redacted].128 as an application-sign-in vector using vendor credentials, and others associated with password spraying and failed logins.
In logs spanning over 10,000 tenants with ConnectWise applications, only the 144.172.64.[redacted].128 address and Microsoft-internal ranges showed application sign-in activity; other addresses in the same provider range displayed password spray or failed login attempts. A second tenant is said to have experienced post-compromise activity via a similar method, where a compromised application granted itself Global Administrator rights and added a new secret to other applications for persistence.
While Microsoft Graph reads were observed, there is no indication of mailbox or file manipulation or broader policy changes. ConnectWise continues to monitor and validate containment as it restores services.