ConnectWise disabled affected application connections and suspended Cloud Backup after an incident involving application identities.
Huntress observed sign-ins using vendor credentials and post-compromise activity in a second tenant, including an application granting itself Global Administrator.
ConnectWise says it has seen no successful threat activity in the environments it monitors.
The incident response also included replacing application credentials and publishing guidance for partners.
What ConnectWise did
The company disabled affected application connections and temporarily suspended Cloud Backup. It also proactively suspended SaaS Security and Cloud Management services, because they are connected to Cloud Backup.
ConnectWise said it has strengthened administrator access protections, reset accounts and replaced application logins. It has sought the help of independent experts to investigate and respond to the incident. It has also published guidance to help its partners check for unauthorized actions and address any they find.
The company said it has not detected any successful malicious activity in the environments it monitors. It also said its other products are not affected.
READ ALSO
Russian hacker group hits warship shipyard and NATO military targets
What did Huntress spot?
Security firm Huntress reported that the primary route of access was through app logins with ConnectWise credentials. It also saw multiple failed login attempts from other addresses from the same provider, but believes they are likely unrelated to the app logins.
In a second, separate environment, Huntress spotted an app that gave itself very high administrator privileges. She also saw that the app added a new digital access key to a few other apps.
Huntress found no evidence that the attackers used the access to tamper with emails or files, or to change users and settings.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
