S0:E54: ConnectWise's OAuth Breach Hit 162 Tenants and Killed Their Backups
ConnectWise disclosed over the weekend that threat actors used existing OAuth credentials to take over Microsoft 365 tenants through its Cloud Management platform — Huntress has confirmed 162 tenants impacted so far, with ConnectWise's own SkyKick backup service shut off entirely as a result. Jess and Jake break down how the attack chain worked (compromised OAuth service principals granting themselves Global Administrator, then adding credentials to other apps), why a backup provider has to be a near-hostage to your tenant's directory with close-to-global-reader access, and the hard incident…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.