[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f28266L84VFwp5BNJ9Cg2t9DaExxKQ9tjoo1DYRap5HU":3},{"article":4,"iocs":56,"watch_terms":74,"solutions":75,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"991bba8e-9c68-45b1-b9e6-88b7dc87e387","Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack-622bd9","ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. [...]","ConnectWise has suspended its Cloud Backup service after hackers exploited application identities to gain unauthorized access to Microsoft 365 tenants. The attack, which began around October 15th, leveraged compromised service principals, bypassing multi-factor authentication. At least 162 tenants were confirmed compromised, with attackers assigning themselves administrative roles and accessing sensitive data.","Hackers compromised Microsoft 365 tenants via ConnectWise's Cloud Backup service.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F07\u002FConnectWise.jpg","2026-10-17T15:18:51+00:00","2026-10-17T16:00:11.711554+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Cloud Backup service",{"name":23,"type":24},"ConnectWise","vendor",{"name":26,"type":24},"Microsoft",{"name":28,"type":29},"Microsoft Entra ID","technology",{"name":31,"type":32},"SkyKick\u002FCW breach","campaign","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,65,68,71],{"type":58,"value":59,"context":60},"ip","144.172.64.128","IP address associated with malicious activity",{"type":62,"value":63,"context":64},"mitre_attack","T1078.004","Valid Accounts: Cloud Accounts",{"type":62,"value":66,"context":67},"T1558.003","Steal or Forge Credentials: Multi-Factor Authentication (MFA) Bypass",{"type":62,"value":69,"context":70},"T1078","Valid Accounts",{"type":62,"value":72,"context":73},"T1136.003","Create Account: Cloud Accounts",[23,26,18],{"controls":76,"vendors":155},[77,104,132],{"slug":78,"name":79,"problem":80,"products":81},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[82,90,96],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":91,"vendor_name":26,"vendor_logo":92,"product_slug":93,"product_name":28,"url":94,"description":95},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":105,"name":106,"problem":107,"products":108},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[109,116,124],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":105,"product_name":113,"url":114,"description":115},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":133,"name":134,"problem":135,"products":136},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[137,142,150],{"vendor_slug":91,"vendor_name":26,"vendor_logo":92,"product_slug":138,"product_name":139,"url":140,"description":141},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":151,"product_name":152,"url":153,"description":154},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",[156,162],{"slug":157,"name":158,"logo_path":159,"roles":160},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png",[161],"reported_by",{"slug":91,"name":26,"logo_path":92,"roles":163},[164],"affected",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":187},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","Attackers exploited compromised application identities (service principals) within ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenant environments, bypassing MFA entirely because the attack operated through trusted service-level credentials rather than user accounts. This highlights a critical blind spot in MFA strategies: machine-to-machine identities and service principals are often unprotected by the same authentication controls applied to human users. Once inside, attackers escalated privileges by assigning themselves administrative roles, demonstrating how a single compromised third-party integration can cascade into full tenant takeover. Supply-chain attacks of this nature are particularly dangerous because organizations implicitly trust their vendors' tools, often granting them broad permissions with little ongoing oversight.",[170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 15 – Service Provider Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-9 (Service Identification and Authentication)","NIST SP 800-53 AU-6 (Audit Record Review and Analysis)","NIST SP 800-53 SA-9 (External System Services)","NIST CSF ID.SC-4 (Supply Chain Risk Management)","NIST CSF PR.AC-4 (Access Permissions Management)","ISO\u002FIEC 27001 A.9.2 – User Access Management","ISO\u002FIEC 27001 A.15.1 – Information Security in Supplier Relationships","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","MITRE ATT&CK T1098.003 – Account Manipulation: Additional Cloud Roles",{}]