ConnectWise CTO On Cloud Backup Cyberattack, M365 Update And Helping Thousands Of Partners

‘We are running as fast as we possibly can, while maintaining that we don’t create shortcuts for ourselves in order to rush things to market, to make sure the service is safe, secure, the environment is clean, and we will bring it back online,’ ConnectWise CTO David Raissipour tells CRN.

ConnectWise’s David Raissipour says his company is doing everything possible to help thousands of ConnectWise partners affected by the recent attack on its Cloud Backup product, with no suspicious activity witnessed in more than 24 hours.

“Every single partner that has reached out and asked for help, we have jumped right in. Every single one,” said Raissipour, chief technology and product officer of ConnectWise, in an interview with CRN.

“We are running as fast as we possibly can, while maintaining that we don’t create shortcuts for ourselves in order to rush things to market, to make sure the service is safe, secure, the environment is clean, and we will bring it back online,” he said.

ConnectWise has suspended access to its Cloud Backup service after a suspected supply chain cyberattack targeting users of Microsoft 365.

ConnectWise CTO On Cyberattack: ‘I Do See Daylight’

Some of ConnectWise’s SaaS security and cloud management services were also suspended as they are connected to Cloud Backup, which was formerly known as SkyKick.

Cloud Backup is a cloud-based backup and recovery service built for MSPs to protect their clients’ Microsoft 365 or Google Workspace data.

“I can confirm that we have not seen activity in our environment for more than 24 hours,” Raissipour said.

“I do see daylight,” he said. “We see light at the end of the tunnel.”

‘This Has Nothing To Do With Microsoft;’ Contained Any Access To M365

Raissipour said ConnectWise has been in constant contact with Microsoft since the suspected attack.

“Let me make sure this is very clear. This has nothing to do with Microsoft,” he said.

“This is something that we work with our partners to do, and we will help them make sure that their Microsoft environment is safe and secure,” he said. “ConnectWise believes we have contained any access to their environment. … The service SkyKick has over 4,000 Azure services that we need to bring back online.”

In an interview with CRN, Raissipour takes a deep dive into what ConnectWise is doing right now for partners and how it is currently handling the cybersecurity incident.

Has your backup data been accessed by a threat actor?

I can confirm that we have zero evidence that our backup data was accessed by any potential threat actor.

The reason for that also is all of that backup data is encrypted, stored separately.

So it is using identities associated with a service principle to create this type of situation for partners.

When we shut down the service, we revoked our access to the Microsoft 365 tenant environment, which means any credential that is out there can no longer be used to access that environment.

That does not mean that partners are safe.

It simply means that can no longer be used to access their environment.

What has ConnectWise done to try to help?

First and foremost, while incredibly disruptive, shutting down the service is not something that we took lightly.

We took that step because it cuts off any further access immediately.

But because we wanted to make sure that we did whatever we could to protect partners, we shut that off.

We also suspended two additional services that also use similar methods of authentication with Microsoft 365. And this is our Cloud Manager and our SaaS security products. We did that out of an abundance of caution. We did not see any activity there.

I can also confirm that there has been zero detected activity or zero impact to any other ConnectWise product.

This is isolated to a specific service and a specific set of credentials used by that service to authenticate.

What update can you give us on when you think Cloud Backup may be back up and running?

The investigation is ongoing. We have not concluded the investigation. Because, as you can imagine, it would be catastrophic if we brought service back online without knowing that the environment is safe and secure.

So instead of doing it right now, we’re going to do it the right way.

I can confirm that we have not seen activity in our environment for more than 24 hours.

As a matter of fact, once we revoked credentials from our applications, we saw some activity. All of it failed.

We have not seen any activity in our environment for a period of time. We’re continuing to monitor. We’re continuing to do this the right way.

The service SkyKick has over 4,000 Azure services that we need to bring back online.

And to bring them back online, we need to rotate certificates. We need to do all of those things to bring the service back online.

We are running as fast as we possibly can, while maintaining that we don’t create shortcuts for ourselves in order to rush things to market, to make sure the service is safe, secure, the environment is clean, and we will bring it back online.

Three times a day we will provide an update on that status.

What’s your message to partners who need help right now?

Reach out to our support organization. Reach out to our SOC. Reach out to the security email alias that we have shared with all of them.

I have personally emailed partners and informed them of what was happening.

That was not a bot using my email account. I sat there and wrote those emails and sent them out myself.

They have my email address. They have the email address of our executives. They have the email address of our partner success and support organizations and our phone numbers.

Any partner that reaches out and says, ‘Hi, I need help,’ we are there and we will help them in real time.

We answer questions. We look up information for them. Anything that we have visibility into, we share with them. We update our trust center three times a day. We send email communications to our partners three times a day.

Just last night, we found two additional IP addresses in our investigation that we believe are malicious. We posted those immediately and made sure that we identified this for our partners.

So it is our responsibility to share every piece of information that we can with our partners to help them through this process.

How many ConnectWise partners have you helped?

Every single partner that has reached out and asked for help, we have jumped right in. Every single one.

I know they have reached out to me directly.

I have gone and looked up IP addresses that they were unsure of to give them an answer of ‘Yes, this IP address is safe’ or ‘Yes, this IP address is not safe.’

So every single partner that reaches out, or to any member of our SOC, or anybody else—we understand and will assist.

Can you explain the situation and how many ConnectWise partners have been affected?

It is a couple of thousand partners that use Cloud Backup.

This is the product that provides backup for Microsoft 365 tenants.

As you’re probably aware, products such as this product, they’re Azure Enterprise applications.

The way access is managed is a partner really grants access to the application. That application creates a set of credentials. Those credentials are used to identify itself to Microsoft 365.

It then generates a token for that session with the right entitlements and the permissions that the partner has given the application, so that it can perform things like backup of SharePoint, backup email, backup of those types of things.

And that token is only good for a period of time, and then the token goes away. The credential that the service principle uses is a unique credential for that service principle.

The reason we took the service down is because there was access to that credential.

And that credential then allows a potential threat actor to go fake their identity as the enterprise application. And then use that to directly access Microsoft 365. Not our environment—Microsoft 365.

What are you doing with Microsoft now? How is that going?

So let me make sure this is very clear. This has nothing to do with Microsoft. ...

Microsoft is in constant contact with us.

They provide us threat information. They provide us help as needed.

This is something that we work with our partners to do, and we will help them make sure that their Microsoft environment is safe and secure.

But this has nothing to do with Microsoft.

We want to also make sure that our partners’ Microsoft 365 environment is safe. And that threat actors have not accessed data directly that way. We will help them every step of the way.

Is there anything you want to stress to your channel?

The thing that I want to stress, which is very, very important—all of our investigation, ours as well as third-party forensic investigation—there’s been zero access to the backup and archive data that we have.

The credentials that are used to talk to the service do not give you access to the archived data. That’s a separate encryption mechanism that sits in place for all that data at rest.

So that is safe and secure.

What is your message to ConnectWise partners?

ConnectWise believes we have contained any access to our environment.

We’re continuing our investigation to ensure that the environment is safe and secure, and we are working in parallel on service restoration.

I do see daylight. I do.

We see light at the end of the tunnel.

We have made significant progress in our investigation and remediation activities.

One of the critical steps is to make sure that activity ceases in that environment. And not having seen activity in the environment for an extended period of time now is one of those indicators that we see a light at the end of this tunnel.

I will personally respond to every partner that reaches out and asks for help.