ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after an unidentified threat actor accessed a sensitive API credential. Researchers from Huntress observed sign-in activity across nearly 1,000 Entra tenants, with over 300 sign-ins appearing successful. The compromised credential allowed attackers to bypass multi-factor authentication and access Microsoft 365 applications like Exchange Online and SharePoint. ConnectWise confirmed unauthorized sign-ins in 162 tenants and stated that restoration efforts are ongoing without a confirmed timeline. The company and researchers have shared indicators of compromise to help customers identify malicious activity.
Read the full story at cyberscoop.com.
Photo: unknown (CC0) via Openverse
