Hackers Abuse Compromised ConnectWise Credential to Gain M365 Access

Cybersecurity researchers have sounded the alarm over an active campaign where unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. The compromised credential was obtained through a phishing attack, which was then used to sign in to 173 Microsoft 365 tenants. This campaign has significant implications for managed service providers (MSPs) and their customers, as it highlights the importance of robust security measures to protect against such attacks. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for MSPs, and its compromised credential has been used to gain access to customers' M365 environments. The researchers are urging MSPs to take immediate action to secure their customers' M365 environments and to implement additional security measures to prevent such attacks. This includes updating their M365 tenant passwords, enabling multi-factor authentication, and monitoring their environments for suspicious activity. By taking these steps, MSPs can significantly reduce the risk of their customers' data being compromised. The incident highlights the importance of robust security measures and the need for MSPs to prioritize their customers' security. Source: The Hacker News