Supply-Chain Attack on ConnectWise Cloud Backup

A threat actor obtained a credential (API secret) belonging to ConnectWise Cloud Backup, and ConnectWise has confirmed that it is being used to gain unauthorized access to customers’ Microsoft 365 environments. The speed with which the threat actor gained initial access across the affected organizations suggests that this part of the attack was automated. In one case, the threat actor not only accessed the victim organization’s environment but also granted itself the Global…

Diamond Model