Knowledge Base Digest - September 2024

Following ConnectWise’s disclosure of unauthorized access to its Cloud Backup app on 16 October, our SOC has been reviewing customer environments and helping partners contain exposure.

If you use ConnectWise Cloud Backup with Microsoft 365, we recommend:

✅ Disable the affected ConnectWise enterprise app IDs in Entra ID
✅ Review sign-in and account activity from 144.172.64[.]128
✅ Check for unexpected privilege escalation on related accounts
✅ Watch for ConnectWise guidance before re-enabling

WatchGuard MDR customers: we’ve already alerted you to any privilege escalation tied to these accounts.

Full details and App IDs here: WatchGuard Support Center