[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffmtOcMFhP5ahzIjqPA9k1Mehqa_bimZFP63OIgMymRQ":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"fd42b41e-f01a-4845-bf72-d236b0585485","ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants","connectwise-suspends-cloud-backup-after-attackers-compromise-microsoft-365-tenan-1a74dd","ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise","ConnectWise has suspended its cloud backup service after threat actors gained unauthorized access to application identities and compromised Microsoft 365 tenants. The company disabled seven ConnectWise application identities as part of its ongoing investigation into the incident.","ConnectWise disables cloud backup after attackers compromise Microsoft 365 tenants.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fconnectwise-suspends-cloud-backup-after.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjxTJ5xsWsmrBmF1q18Gi5uaokNeC6-M0VbSf0T5X3KMQH7QGMhC7mz4XB6TUJuE7P9tjknMAqaGQ-Iz_7UuQ-NdKKXJTgqLhHMipRcd57VUOpwfJ2xxO8Hq_PX8hotdp_KZddNDzfQFw3bLHbYYLasThNbqGlidzhZ485ApBIKh2KUgn4g6PeBbhMwhc0T\u002Fs1600\u002Fms-connect.jpg","2026-10-18T08:23:02+00:00","2026-10-18T10:00:08.770883+00:00",8,[17,20,23,25],{"name":18,"type":19},"ConnectWise Cloud Backup","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"Microsoft 365",{"name":26,"type":27},"application identities","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":28,"icon":30,"name":31,"slug":32},null,"Breaches","breaches",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,55],{"type":53,"value":18,"context":54},"malware","Disabled application identity related to the incident",{"type":53,"value":56,"context":57},"506e08f9-6e9a-4da4-942b-a099a03644ae","Application identity ID compromised in the incident",[21,18,24],{"controls":60,"vendors":145},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":120,"name":121,"problem":122,"products":123},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":133,"product_name":134,"url":135,"description":136},"idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",[146],{"slug":104,"name":105,"logo_path":106,"roles":147},[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":167},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","Threat actors gained unauthorized access to ConnectWise application identities, enabling them to compromise Microsoft 365 tenants relying on the platform's cloud backup service. This incident highlights the cascading risk of compromised service application identities — when a trusted integration is hijacked, attackers inherit broad access to connected customer environments. The decision to suspend the cloud backup service underscores how a security incident in a managed service provider can simultaneously impact many downstream organizations. Businesses depending on third-party backup solutions must understand that their data protection posture is only as strong as their provider's security controls.",[154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST CP-9: System Backup","NIST SA-9: External System Services","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ISO 27001 A.12.3: Information Backup","ISO 27001 A.15.2: Supplier Service Delivery Management",{}]