Compromised ConnectWise Cloud Backup vendor credentials led to unauthorized sign-ins across 173 partner and customer tenants.
Security researchers observed automated tenant enumeration and unauthorized privilege escalation within specific environments, prompting ConnectWise to temporarily suspend application access.
The case concerns the ConnectWise Cloud Backup application, which is widely used by IT companies to store files and data in professional office services. Because the application performs backups, it has extensive access rights to emails, storage files and contact lists.
According to cybersecurity firm Huntress, the attackers used the stolen key to log in without permission to 173 different client organizations. Their movements were recorded on October 15, with the attackers automatically moving from one system to another in just a few seconds. With the permissions the app had, this access allowed them to read emails, documents and address data.
In at least one case, researchers found a separate application from the same company independently upgrading its privileges to full administrative level and adding new digital keys to other trusted tools, creating potential access corridors to additional systems.
READ ALSO
Data on 1,4 million patients and employees of Central Ohio Primary Care was exposed
In response to the incident, ConnectWise decided to temporarily suspend the application, closing access until further notice. At the same time, it announced that there is no indication that the backup data itself has been compromised.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)