ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

SaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access.

ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments.

Cloud Backup is one of those tools and does what it says on the tin for data stored on-prem, in the cloud, or in SaaS services like M365 and Google Workspace.

On October 16, the company published an advisory revealing that on the 15th it “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.” “The service interruption affects partners and customers using Cloud Backup, formerly known as SkyKick.

Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services have also been suspended out of an abundance of caution while our investigation and remediation continue,” the company advised.

The suspension does not mean MSPs, or their customers, should assume that their environments were compromised, just that ConnectWise isn’t confident it can operate its services safely at this time.

As of 16:00 UTC on October 18, the services remain unavailable, which means end-users can’t back up data, access their archives, or restore data.

“Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access.

Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities,” the company’s veep of security operations, Jason Ferguson, wrote on Reddit.

ConnectWise has not offered much detail on the incident, other than to publish some indicators of compromise it thinks are tied to a handful of IP addresses and integrations with third-party apps.

It has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products.

Security outfit Huntress offered a starker view and wrote “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments.” “In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner.” “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added,” the firm warns.