“We’re going to work through the weekend,” says ConnectWise Chief Technology Officer David Raissipour. “We’re going to do everything possible to get this done by the end of the week.”
ConnectWise is aiming by the end of this week to provide thousands of its MSPs with access once again to ConnectWise Cloud BackUp for Microsoft 365 and other services impacted by a security breach, said ConnectWise Chief Technology Officer David Raissipour.
“We have said this will take a few days,” said Raissipour. “We’re going to work through the weekend. We’re going to do everything possible to get this done by the end of the week.”
Raissipour’s sanguine outlook comes four days after ConnectWise shut down access to ConnectWise Cloud Backup, SaaS Security and Cloud Management for thousands of MSPs as part of its response to a breach of Cloud Backup, formerly SkyKick. That shut down came after ConnectWise learned Cloud Backup had been compromised and was being used to gain unauthorized access to Microsoft 365 tenants.
The service restore for partners to regrant access to Cloud Backup and the other services takes about 5 to 10 minutes per tenant, said Raissipour. “That has to be done on the partner side,” he said. “We need them to go through that explicit step.”
Raissipour (pictured) reaffirmed that none of the ConnectWise backup data archives was impacted by the security breach. “None of that was touched or compromised,” he said.
As for the potential data exfiltration impact on MSP Microsoft 365 tenants, Raissipour said ConnectWise is continuing a full-court press offensive to work with its MSPs to see if there was any “access to data” from Microsoft 365 tenants.
Threat researcher Huntress has reported that it had seen threat activity involving ConnectWise Cloud Backup and Cloud Management applications with sign-in activity from the “malicious infrastructure” across more than 1,000 Microsoft tenants, “more than 300 of which appeared to succeed,” said Huntress Principal Security Operations Analyst Jonathan Semon. That said, he cautioned that in some of those 300 cases the application was not present so “success” does not always mean “access,” he said.
ConnectWise has been running tutorial sessions and webinars every two hours, 24 hours a day, seven days a week, to help partners determine indicators of compromise (IOCs) in Microsoft 365 tenants.
“Our security organization is walking MSPs step-by-step how to go into (Microsoft) Entra ID and look for indications of compromise and elevated privileges,” said Raissipour. “We’ve done this now for literally thousands of partners. We’re going to continue that for as long as our partners want us to. We are not involved in the customer investigation. We can show them how to do it but we are not authorized as an incident response team to go do that for them.”
ConnectWise is going to be sharing soon on its trust center automation scripts aimed at helping MSPs identify “indicators of compromise” (IOCs) faster, said Raissipour.
Keith Nelson, CEO of Irvine, Calif.-based MSP Vistem Solutions, which is a ConnectWise customer, praised ConnectWise for how it has handled the Cloud Backup breach and for providing automation scripts to help MSPs identify IOCs.
“That is huge,” said Nelson. “For those that don’t have the staffing or cybersecurity skills to detect suspicious Microsoft 365 tenant activity that is going to make a big difference. It seems to me, ConnectWise is going above and beyond to help MSPs detect any suspicious anomalies in the MSP logs. We have a full-time staff member watching these logs. Smaller MSPs can’t afford that. The smaller MSPs need the help of ConnectWise to protect their clients from these kind of rogue attacks. These things happen. ConnectWise handled it the best way anybody possible could.”
Nelson said he is heartened ConnectWise is bringing Cloud Backup and other services back online and looking forward to seeing the MSP platform maker continue to help MSPs protect themselves and their customers. “We need partners like ConnectWise to help MSPs provide resiliency and business redundancy,” he said.
In the wake of the attack, ConnectWise is also working with Microsoft on measures it could take to provide additional protection, said Raissipour. “That is something that is ongoing,” he said.
Hundreds of ConnectWise employees have been working around the clock with “very little sleep” for the last six days to investigate and remediate the breach, said Raissipour.
When asked by an MSP at a town hall when the investigation will stop, Raissipour said: “Look we have monitoring on our services all the time. This investigation is never going to stop because we never stop monitoring. The security measures we had in place were one of the reasons we identified exactly what this was so we could turn it off.”
ConnectWise is also in the process of building its own home-grown service credential Identity Threat Detection and Response (ITDR) software product to protect MSPs, said Raissipour. “We’re going to do everything that we can to make sure we put that in the hands of our partners to make sure that they’re safe,” he said.
That service credential ITDR is critical for smaller MSPs who cannot manage an enterprise ITDR that are “complex and don’t work with multi-tenant environments,” said Raissipour. “We’re building those capabilities.”
Raissipour said ConnectWise continues to increase its security software investments and expand its security software portfolio.
Earlier this year, ConnectWise expanded its partnership with security provider SentinelOne, which is rated as a Magic Quadrant security leader by market researcher Gartner, to advance managed cybersecurity for MSPs and the customers they protect.
“SentinelOne is bringing some of their proven enterprise-grade technology down to MSPs, making it accessible for multi-tenancy,” said Raissipour. “We have also built agentic capabilities in our SOC for the products we have, which is our managed Data Detection and Response (DDR) and managed Security Information and Event Management (SIEM) products.”
ConnectWise has also added email security protection and awareness training.
At the ConnectWise IT Nation conference in Orlando on Nov. 4-6, MSPs will learn about additional products for security governance and compliance, said Raissipour.
Raissipour stressed that he and other members of the leadership team, including ConnectWise CEO Manny Rivelo, have deep cybersecurity software experience. “This is in our DNA,” he said. “We take this seriously and personally. This (ConnectWise software) is our creation.”
