ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.

The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m. UTC, three days after the incident was first identified -

ConnectWise said it's validating the effectiveness of its containment measures and emphasized that it has not seen any successful threat activity in the environments it monitors. There is no evidence that any ConnectWise products and services, other than Cloud Backup and the precautionary suspensions of SaaS Security and Cloud Management, are impacted.

"This observation does not establish whether individual partner or customer Microsoft 365 tenants have been affected," it said. "Reviewing each potentially affected tenant remains essential."

"Before making changes, preserve relevant evidence, validate findings, and assess potential operational impacts. Completing these steps does not guarantee that a tenant is unaffected or that all unauthorized access has been eliminated. Do not reconnect affected applications until ConnectWise provides formal restoration instructions."

Huntress has shared the following IP addresses observed in connection with the activity, adding that the password spray and failed login attempts linked to some of them are unlikely to be related to the application sign-in activity -

]128 and Microsoft-internal ranges are the only addresses that produced application sign-in activity," Huntress researchers said in an update.

Source link