Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants
A single compromised credential tied to ConnectWise Cloud Backup was leveraged by threat actors to access 173 separate Microsoft 365 customer environments, illustrating the cascading danger of supply chain credential compromise. Managed service providers (MSPs) and their tooling represent a high-value, high-trust target because a single breach can propagate instantly across hundreds of downstream clients. The incident underscores how privileged third-party service accounts often lack the same scrutiny as internal credentials, creating a blind spot in access governance. Without robust monitoring and multi-factor authentication on service accounts, attackers can move laterally across tenant boundaries largely undetected.
Tactical Insight
Immediate actions
- Rotate all ConnectWise Cloud Backup credentials immediately and audit active sessions across all associated Microsoft 365 tenants.
- Enforce Multi-Factor Authentication (MFA) on every service account and third-party integration account without exception.
- Review and revoke excessive OAuth permissions or delegated admin rights granted to ConnectWise or any similar MSP tooling.
Long-term improvements
- Implement a least-privilege model for all MSP and vendor service accounts, scoping access strictly to what is operationally required.
- Establish a formal third-party vendor risk management program that includes periodic credential audits and access reviews for all supply chain integrations.
- Adopt Privileged Access Workstations (PAWs) and just-in-time (JIT) access provisioning for all high-privilege MSP accounts.
Detection measures
- Configure Microsoft 365 audit logs and Microsoft Sentinel (or equivalent SIEM) to alert on anomalous sign-in patterns, especially cross-tenant access from unexpected IPs or geolocations.
- Implement Conditional Access policies that restrict MSP service account logins to known IP ranges and compliant devices.
- Schedule regular threat hunting exercises specifically targeting third-party and service account activity across all managed tenants.