Well,... shit.
Things like this are never good when they happen. It feels like each incident like this is something that should have been caught with a good development and deployment workflow along with proper risk and exposure modeling.
UPDATE: We have high-confidence the threat actor has also abused these ConnectWise Cloud Management apps:
-Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519)
-MS Teams (24205314-2b89-4e07-a2a4-579e898a5640)
-SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)
The potential impact of the ConnectWise supply chain attack is massive.
One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants.
Even worse, attackers could establish persistent access by adding credentials to other applications, surviving the revocation of the original compromised credentials.
And with MSPs involved, the potential blast radius could extend even further to downstream customers.
We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup.
linkedin.com/posts/microsof…
2K Followers 621 FollowingA Technology Journalist and cybersecurity professional. I have a mission to remove the marketing-speak from the information people receive in their news.
705 Followers 1K FollowingUnit 42 | Creator of DFIR Labs | Former Captain @teambi0s | DFIR |
Malware Analyst | Maldev | Windows RE | Trounce🦇 | Views My Own
187K Followers 1K FollowingThe National Cybersecurity Alliance is a nonprofit that empowers people to use technology safely & securely. Co-leads Cybersecurity Awareness Month
9K Followers 680 FollowingSr. Net Arch focusing on #MikroTik, #whitebox and #OSS for ISP design. Advocate for #IPv6 & rural ISPs. Husband. Dad. #Chesspunks War Eagle. Geek. #Lego
1K Followers 1K FollowingCyber Security Pro, former GCHQ/NCSC/CPNI/CERT-UK & GFSC, now Director at @blackarrowcyber
OSINT. Early adopter. Horizon Scanner. Opinions my own.
932 Followers 2K FollowingHerder of cats, wrangler of packets, jack of some trades. RFC 3514 compliant. @_dc151 co-(dis)organiser
Also @[email protected] in the other place
25K Followers 27K FollowingA Hacker who is A Lover of People, and Life @RetroTwinz @Secbsd, @GrumpyHackers, @NovaHackers, @deadpixelsec @hacknotcrime Advocate @PositivelyBlue_ OSCP, OSWP
1.2M Followers 158 FollowingWe're a community of millions of people who are learning math, programming, and computer science together. A 501(c)(3) public charity. Tweets by @abbeyrenn.
4K Followers 3K FollowingRegional Threat Protection Tech Lead @Microsoft | Former Microsoft MVP | Father 👭/Husband👫/🍷&⌚️ enthousiast/Explorer ✈️ | Views my own.
5K Followers 1K FollowingTechnical Lead, 🇨🇳 Mission @Google GTIG. Specializing in tracking and attribution of China-Nexus Threats, and making life difficult for them.
7K Followers 797 FollowingFormer attorney, current IT & infosec consultant in the 'Burgh. Happy to talk about password spraying one minute and constitutional law the next. Son of #wvu.
4K Followers 4K FollowingUpdates about all things threat intelligence & updates about stuffs going on in the cybersec, ransomware, OSINT, SOCMINT, and hacking communities #threatintel
22K Followers 274 FollowingOffensive security company. Dojo of many ninjas. Red teaming, reverse engineering, vuln research, dev of security tools and incident response.