IT Management Vendor Disables Application Identities After Cloud Breach
An IT management software vendor recently experienced a security breach where unauthorized threat actors gained access to its application identities. This compromise put customer Microsoft 365 environments at risk, as the stolen credentials could be used to bypass individual user passwords and log in as the application itself.
In response, the vendor immediately disabled seven specific application identities and suspended its Cloud Backup service by revoking the certificates used for affected connections. The disabled identities include the Cloud Backup service, Cloud Management, Cloud Management for MS Teams, Cloud Management for Exchange Online, Cloud Management for MS Graph, Cloud Management for Partner Center, and Cloud Management for SharePoint Online.
The company identified the unauthorized access on October 14th and took action to disable the identities on October 17th. While disabling these connections stops new authentication attempts, it does not reverse any changes the attackers may have already made inside affected environments. Additionally, previously issued access tokens might remain active until they naturally expire, and any unauthorized credentials added separately will require further review.
As a precaution, the vendor has temporarily taken its SaaS Security and Cloud Management platforms offline while the investigation continues. Scheduled backups have stopped running, and access to backup archives and restoration features is currently unavailable. However, the vendor confirmed that the existing backup archives remain encrypted, isolated, and preserved, with no evidence that the attackers breached or accessed the stored backup data.
The attack is particularly severe because it allows threat actors to use the stolen application credentials to authenticate as the application within a customer’s Microsoft 365 tenant. By leveraging the app’s extensive permissions, attackers could access mailboxes, SharePoint documents, Teams messages, and directory information. Furthermore, the attackers could escalate their privileges by adding the application to the Global Administrator role, creating new applications with permissions, or adding client secrets to other trusted apps, establishing a hidden backdoor for persistent access even if the original credentials are revoked.
Investigators observed a second wave of targeted attacks on October 15th, originating from a specific IP address. This wave focused on a narrow scope of 16 tenants in the policy, national security, trade, and critical mineral sectors. Overall, sign-in activity from the suspicious IP was detected across nearly 1,000 environments, with about 300 initial sign-ins succeeding, though some were blocked because the necessary service principal configurations were missing in those tenants.
Partners are urged to take immediate action. Recommended steps include reviewing both their own and their customers’ Microsoft 365 tenants, ensuring the affected applications remain disabled, checking sign-in logs for the suspicious IP address, preserving audit records before taking containment steps, reviewing application credentials and directory roles, and scanning for unauthorized mailbox forwarding or inbox rules.
Frequently Asked Questions (FAQ)
Q: What exactly are application identities?
A: These are special credentials that allow software applications to log into Microsoft 365 and perform automated tasks like backups and management without needing a human user to log in manually.
Q: How did the attackers gain access to these identities?
A: The exact method the attackers used to steal the credentials is still under investigation. It is unclear whether a software vulnerability or a misconfiguration contributed to the compromise.
Q: Can the attackers still access my system even after the identities were disabled?
A: Possibly. Disabling the identities prevents new authentication, but if the attackers managed to add their own client secrets to other applications in your tenant before the lockout, they could maintain access through those alternate methods.
Q: Are my backed-up files safe?
A: Yes. The backup archives themselves remain encrypted, isolated, and preserved. There is no evidence that the attackers breached or accessed the stored backup data. However, you cannot create new backups or restore data at this time.
Conclusion
This incident highlights the critical risks associated with compromised application credentials in cloud environments. When attackers steal high-privilege application identities, they can potentially access vast amounts of sensitive data without triggering individual user alerts. While the vendor has taken decisive steps to disable the compromised identities and isolate affected systems, the threat of lingering unauthorized access remains. Organizations must now actively audit their own Microsoft 365 environments to identify and revoke any backdoors the attackers may have left behind.
Thank you for reading
