State Hackers Exploited 0Day to Breach US Clouds via Commvault
A new SaaS attack campaign is underway—and Commvault was just the first stop.
A sophisticated cyberattack targeting
Commvault’s cloud infrastructure allowed threat actors to access customer data backed up via its
Metallic service for
Microsoft 365. The
U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed the breach, linking it to malicious activity in
Microsoft Azure environments.
What Happened?
- Attackers exploited a zero-day (CVE-2025-3928) in Commvault’s web server, allowing authenticated remote users to execute web shells.
- They stole customer secrets used to connect to M365 backups, potentially gaining access to internal corporate M365 environments.
- The breach impacted Metallic, Commvault’s backup-as-a-service (SaaS) solution, suggesting a broader campaign against cloud providers with weak default configurations.
Key Findings
Initial Alert: Microsoft detected suspicious activity in
February 2025.
Attack Method:
- State-sponsored hackers (suspected APT) used advanced techniques to steal M365 authorization keys.
- While backup data remained intact, some credentials were compromised.
Response:
- Commvault rotated all M365 credentials and tightened cloud security controls.
- The company is working with CISA and industry partners to investigate.
CISA’s Mitigation Checklist
Companies using
Commvault Metallic should:
Monitor Entra audit logs for unauthorized credential changes.
Analyze Microsoft logs (Entra sign-ins, unified audit logs) for anomalies.
Restrict Commvault service authentication to
trusted IP ranges.
Audit Entra app registrations with elevated privileges.
Limit Commvault management interfaces to secure networks only.
Deploy a WAF to block path traversal and suspicious file uploads.
Why This Matters
- Cloud backup providers are prime targets—they hold keys to critical data.
- Supply-chain attacks via SaaS platforms are rising, with attackers exploiting trusted integrations.
- State-backed hackers are increasingly abusing cloud misconfigurations and zero-days.
Lesson: If you use
Commvault Metallic for M365 backups,
check your logs now. This might be just the
first wave of a larger cloud-focused offensive.
