ConnectWise closes Cloud Backup app access after credential compromise

ConnectWise has closed Cloud Backup application access until further notice after attackers used a compromised vendor credential to enter customers' Microsoft 365 environments. Huntress reported confirmed unauthorized sign-ins across 173 partner/customer tenants, with token requests observed on October 15. Attackers inherited the backup application's existing permissions, allowing access to customer mail, files and directory data. In at least one partner tenant, Huntress also found a separate ConnectWise app granting itself Global Administrator privileges and adding credentials to other trusted applications. Todyl said revoking user sessions does not end this access; disabling the app stops new tokens, but existing tokens remain valid for up to 90 minutes. ConnectWise said it found no evidence that partner backup data had been compromised.