[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsve59l-1JP_UgobmeqlzaCVHHRQ85gUh4X2MytX56es":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b1099a47-7a32-4db7-b293-3e78eeec6125","Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","hackers-use-compromised-connectwise-credential-to-sign-in-to-173-microsoft-365-t-614eb3","Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments. ConnectWise Cloud Backup is a cloud-based backup and recovery service built for managed service providers (MSPs","Unknown threat actors are actively exploiting a compromised Microsoft 365 credential associated with ConnectWise Cloud Backup. This credential has been used to gain unauthorized access to 173 customer Microsoft 365 environments, highlighting a significant supply chain risk for managed service providers and their clients.","Hackers use a stolen ConnectWise credential to access 173 Microsoft 365 tenants.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-use-compromised-connectwise.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgel6whr7-1_Lf62w6AJwYfEyic0x1lJ0c-qOfOprMUdm83xpM7rqXbJzplx7BPBUBDD4yUcLWoPvFBhF6HIDORPNNXYj7NfDOTf7YN5lT7p80jxtN6VrTxMjWT0OplFNx0BdjoMmFzk3ssVlbapm7Qfl0Z9_1T7jA_zwz2tbjrxzRircL28mr0zcsci98x\u002Fs1600\u002Fconnectwise.jpg","2026-10-17T06:16:46+00:00","2026-10-17T08:00:07.349231+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"ConnectWise Cloud Backup","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":25,"icon":27,"name":28,"slug":29},null,"Breaches","breaches",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":50,"value":24,"context":51},"malware","Compromised credential belonging to this service used for unauthorized access.",[21,18,24],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":85,"name":86,"problem":87,"products":88},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":114,"name":115,"problem":116,"products":117},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[143],{"slug":61,"name":62,"logo_path":63,"roles":144},[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":167},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","A single compromised credential tied to ConnectWise Cloud Backup was leveraged by threat actors to access 173 separate Microsoft 365 customer environments, illustrating the cascading danger of supply chain credential compromise. Managed service providers (MSPs) and their tooling represent a high-value, high-trust target because a single breach can propagate instantly across hundreds of downstream clients. The incident underscores how privileged third-party service accounts often lack the same scrutiny as internal credentials, creating a blind spot in access governance. Without robust monitoring and multi-factor authentication on service accounts, attackers can move laterally across tenant boundaries largely undetected.",[151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)","NIST SP 800-161 (Supply Chain Risk Management)","NIST CSF ID.SC-4 (Supply Chain Risk)","NIST CSF PR.AC-1 (Identity and Credential Management)","ISO\u002FIEC 27001:2022 A.5.19 (Information Security in Supplier Relationships)","GDPR Article 32 (Security of Processing)","GDPR Article 33 (Notification of Personal Data Breach)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1199 (Trusted Relationship)",{"MITRE ATT&CK T1078 (Valid Accounts)":168,"CIS Control 5 – Account Management":169,"NIST CSF ID.SC-4 (Supply Chain Risk)":170,"NIST SP 800-53 AC-6 (Least Privilege)":171,"GDPR Article 32 (Security of Processing)":172,"NIST SP 800-53 AC-2 (Account Management)":173,"MITRE ATT&CK T1199 (Trusted Relationship)":174,"CIS Control 6 – Access Control Management":175,"NIST SP 800-161 (Supply Chain Risk Management)":176,"NIST SP 800-53 IA-5 (Authenticator Management)":177,"CIS Control 17 – Incident Response Management":178,"CIS Control 12 – Network Infrastructure Management":179,"NIST CSF PR.AC-1 (Identity and Credential Management)":180,"GDPR Article 33 (Notification of Personal Data Breach)":181,"NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)":182,"ISO\u002FIEC 27001:2022 A.5.19 (Information Security in Supplier Relationships)":183},"Attackers used a valid credential to access tenants, the technique this entry describes.","Account management for privileged service credentials would limit the damage of a single compromised ConnectWise credential.","Assessing supply chain risk includes reviewing how MSPs protect credentials that reach customer tenants.","Least privilege limits what MSP backup credentials can access in customer tenants.","Securing third-party access to systems processing personal data is part of Article 32.","Account management ensures service accounts used by MSP tools are tracked and reviewed.","Abuse of the MSP's trusted access to customers is the technique this entry describes.","Access control management ensures a single credential cannot reach 173 tenants.","Supply chain risk management helps customers assess the risks of MSP tooling access.","Authenticator management requires protecting and rotating credentials used across many tenants.","Incident response helps MSPs and customers coordinate quickly when a shared credential is compromised.","Network infrastructure management can restrict where MSP tools connect from, limiting misuse.","Credential management helps ensure MSP credentials are strong, scoped and monitored.","Unauthorised access to customer tenants with personal data may require Article 33 notification.","Integrity monitoring helps detect unauthorised changes made through compromised MSP access.","Supplier relationship security requires agreeing controls with MSPs that hold privileged access."]