Hackers Accessed 173 Microsoft 365 Tenants with ConnectWise Credential
Cybersecurity researchers have reported an active campaign abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup. Unknown threat actors gained unauthorized access to 173 different Microsoft 365 tenants using this credential.
Summary: Cybersecurity researchers have reported an active campaign abusing a compromised Microsoft 365 credential belonging to ConnectWise Cloud Backup. Unknown threat actors gained unauthorized access to 173 different Microsoft 365 tenants using this credential.
This incident once again highlights the critical importance of third-party integrations and supply chain security. By compromising a Microsoft 365 credential belonging to ConnectWise Cloud Backup, attackers gained access to M365 environments of numerous different organizations. This carries the potential for a widespread security breach.
Technically, the attackers likely used a compromised credential such as a service account or an API key. Such credentials can often have broad permissions and provide access to multiple tenants. This situation underscores the importance of identity and access management (IAM) strategies, especially in cloud-based services.
Such a breach creates serious risks of data leakage, ransomware attacks, or business disruptions for affected organizations. Infrastructure engineers and security teams should regularly audit the security posture of third-party integrations and enforce the principle of least privilege.
All organizations should regularly review credentials used for third-party integrations and enforce additional security layers like multi-factor authentication (MFA). Furthermore, advanced threat detection systems should be used to monitor suspicious login activities.
🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar