Proxyjacking Campaign Hijacks NAS Servers and Video Recorders to Resell Owners' Bandwidth
GreyNoise detailed a proxyjacking campaign that hijacked at least 143 NAS servers and NVRs in 34 countries to resell owners' bandwidth via Pawns.app.
Incidents
ConnectWise Disables Microsoft 365 Integrations After Access Credentials Compromised
ConnectWise disabled seven app identities and suspended Cloud Backup. Admins must check Microsoft 365 for credentials attackers may have left behind.
ConnectWise has suspended Cloud Backup and disabled seven application identities after detecting unauthorized access. A vendor update posted on October 18 at 01:00 UTC (03:00 in Poland) confirms that the certificates used by the affected connections have been revoked.
What’s new
The first advisory came out on October 16, so the incident itself happened before this reporting window. What’s new are the steps taken to cut off access and the detailed guidance for reviewing customer environments, published on October 17 and overnight into October 18. The story is still developing.
ConnectWise says the seven identities were disabled on October 17 at 07:00 UTC. The vendor notes that this does not undo any changes made earlier inside customer environments. In its October 17 advisory, ConnectWise also said there were no signs that stored backups had been compromised.
Why other applications need checking too
In separate research, Huntress described a case where application access was used to add new credentials to other trusted applications in a single customer environment. Access left behind this way has to be removed separately. Blocking the original integration alone does not complete the response.
An application that runs backups may have permissions covering email and files. That’s why the review should cover application identities, their permissions and their change history.
What to do now
- Identify ConnectWise integrations and any older SkyKick entries in Microsoft Entra.
- Review service principal sign-in logs, not just user sign-ins.
- Look for new secrets, certificates, consents and role assignments, and get an explanation for every unauthorized change.
- Preserve the logs and confirm with the vendor whether backups are running and whether data can be restored.
- Bring integrations back online only by following the vendor’s current instructions.
SecurHUB’s take
Application access needs its own oversight because it can run without any employee signing in interactively. Incident response should identify every access path left behind and preserve evidence for analysis.
Sources: ConnectWise, Huntress.
