Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack

Hackers conducted a supply-chain attack by compromising ConnectWise's Cloud Backup service, leveraging stolen application identities to gain unauthorized access to Microsoft 365 tenants. The attackers used a single IP address (144.172.64[.]128) to authenticate as the backup application via its secret, bypassing MFA and exploiting broad permissions previously granted in customer tenants. Multiple cybersecurity firms observed malicious activity including reconnaissance, privilege escalation to Exchange and Global Administrator roles, and attempts to establish persistence by adding credentials to third-party tools. ConnectWise shut down customer access to the service, but existing tokens remain valid until expiration, requiring manual review and revocation by administrators.

AI-extracted · verify before operational use