ConnectWise takes two more services offline, and restores stop

ConnectWise has switched off two more of its Microsoft 365 services while it investigates the theft of the credential behind its Cloud Backup app. A status page update late on October 17 said it had pulled SaaS Security and Cloud Management as a precaution. That stops SaaS Security's monitoring and alerting and Cloud Management's user and license management. Partners are told to ask ConnectWise Partner Care for any change they would normally make through those tools.

The same update says Cloud Backup, the product formerly sold as SkyKick, is still suspended. No scheduled backups are running, restores are unavailable, and ConnectWise has given no time for either to return. The Register reported that at 16:00 UTC on October 18, customers could not back up, open their archives or restore. Jason Ferguson, ConnectWise's VP of security operations, wrote on Reddit that the archives remain encrypted, isolated and preserved, according to The Register.

For a company whose managed service provider runs these tools, the jobs they did now have to be done by hand in the Microsoft 365 admin center, and the clean-up from the breach is still open. ConnectWise says it cannot see into customer tenants, and The Register points out that providers are not obliged to tell clients which platforms they use. So the first job is finding out whether the apps are in your tenant at all.

The seven app identities

ConnectWise says it disabled seven application identities at 07:00 UTC on October 17. The Hacker News lists them, and Triskele Labs, an Australian security firm, published their application IDs:

Older tenants may show SkyKick names. Huntress, which first raised the alarm publicly, told The Hacker News that the Exchange Online, Teams and SharePoint management apps did not appear to have been disabled. Check each one yourself.

Disabling an app stops new sign-ins. It does not undo anything the attacker already did. ConnectWise's own status page says tokens issued before the shutdown may keep working until they expire. In one tenant, the Teams management app made itself Global Administrator and gave new passwords, valid until 2028, to two other apps, an MSP management tool and Huntress's own app. Huntress has since removed the ones it found, but credentials like these survive the shutdown, which is why it says to review credentials on every app in the tenant.

Huntress first confirmed unauthorized sign-ins in 162 tenants. It has since found almost 1,000 tenants with sign-in activity from the attacker's address, 300 of them successful, The Hacker News reported. ConnectWise has not said how the credential was stolen. The Register compares the episode to the 2021 attack on Kaseya, where a supplier to service providers became the route into their customers.