Hackers Hijack ConnectWise Cloud Backup Credential to Breach 173 Microsoft 365 Tenants

Threat actors compromised a Microsoft 365 vendor credential for ConnectWise Cloud Backup, using it to breach 173 partner and customer tenants. The hijacked credential allows attackers to generate Microsoft Graph tokens, inheriting the backup app's extensive read and write access to mailboxes, OneDrive, SharePoint, and Teams chats. In at least one tenant, the attackers granted themselves Global Administrator privileges and added new client secrets to other privileged tools, including an MSP management application and the Huntress Security Platform. ConnectWise has suspended all access to the Cloud Backup application until further notice, though already-issued Microsoft Graph tokens can remain valid for up to 90 minutes. "The app's credential is in hostile hands. It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC." — Jonathan Semon