Episode Details

Today’s headline news for Canadian IT solution providers:

• ConnectWise works to restore cloud services after Microsoft 365 security incident: ConnectWise continues investigating unauthorized access involving application identities associated with Cloud Backup, formerly known as SkyKick, after attackers used compromised credentials associated with the service to authenticate to customer Microsoft 365 environments.The company discovered the activity October 15 and subsequently disabled seven application identities. It also suspended Cloud Backup, SaaS Security and Cloud Management while conducting its investigation and validating remediation measures.

  As of Monday evening, the services had not been restored. Scheduled backups, access to affected backup archives and restoration capabilities remained unavailable, along with SaaS Security monitoring and certain Cloud Management functions.

  ConnectWise chief technology officer David Raissipour told CRN in an interview Monday that the disruption affects several thousand MSP partners worldwide. He said the company has made significant progress toward safely restoring services, although no restoration timetable has been confirmed.

  The underlying security incident extends beyond the operational disruption.

  Independent research by Huntress documented unauthorized Microsoft 365 authentication using a compromised ConnectWise Cloud Backup credential, with unauthorized sign-ins confirmed across more than 160 customer tenants.

  Huntress also identified activity in which a separate ConnectWise Cloud Management application assigned itself Global Administrator privileges in one tenant and added credentials to other trusted applications.

  That finding is significant because disabling the original affected app