[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxz2cXoxAZ4-IESf3ihEZpHHaUeHnwcnAXK1BfvTy3LY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":28,"status":45,"created_at":46,"published_at":47,"article":48,"tags":52,"podcasts":71,"controls":78},"c08457c3-86b5-40de-8f20-a855d5c733a5","compromised-connectwise-credential-exposes-173-microsoft-365-tenants","b1099a47-7a32-4db7-b293-3e78eeec6125","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","A single compromised credential tied to ConnectWise Cloud Backup was leveraged by threat actors to access 173 separate Microsoft 365 customer environments, illustrating the cascading danger of supply chain credential compromise. Managed service providers (MSPs) and their tooling represent a high-value, high-trust target because a single breach can propagate instantly across hundreds of downstream clients. The incident underscores how privileged third-party service accounts often lack the same scrutiny as internal credentials, creating a blind spot in access governance. Without robust monitoring and multi-factor authentication on service accounts, attackers can move laterally across tenant boundaries largely undetected.","**Immediate actions:**\n- Rotate all ConnectWise Cloud Backup credentials immediately and audit active sessions across all associated Microsoft 365 tenants.\n- Enforce Multi-Factor Authentication (MFA) on every service account and third-party integration account without exception.\n- Review and revoke excessive OAuth permissions or delegated admin rights granted to ConnectWise or any similar MSP tooling.\n\n**Long-term improvements:**\n- Implement a least-privilege model for all MSP and vendor service accounts, scoping access strictly to what is operationally required.\n- Establish a formal third-party vendor risk management program that includes periodic credential audits and access reviews for all supply chain integrations.\n- Adopt Privileged Access Workstations (PAWs) and just-in-time (JIT) access provisioning for all high-privilege MSP accounts.\n\n**Detection measures:**\n- Configure Microsoft 365 audit logs and Microsoft Sentinel (or equivalent SIEM) to alert on anomalous sign-in patterns, especially cross-tenant access from unexpected IPs or geolocations.\n- Implement Conditional Access policies that restrict MSP service account logins to known IP ranges and compliant devices.\n- Schedule regular threat hunting exercises specifically targeting third-party and service account activity across all managed tenants.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)","NIST SP 800-161 (Supply Chain Risk Management)","NIST CSF ID.SC-4 (Supply Chain Risk)","NIST CSF PR.AC-1 (Identity and Credential Management)","ISO\u002FIEC 27001:2022 A.5.19 (Information Security in Supplier Relationships)","GDPR Article 32 (Security of Processing)","GDPR Article 33 (Notification of Personal Data Breach)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1199 (Trusted Relationship)",{"MITRE ATT&CK T1078 (Valid Accounts)":29,"CIS Control 5 – Account Management":30,"NIST CSF ID.SC-4 (Supply Chain Risk)":31,"NIST SP 800-53 AC-6 (Least Privilege)":32,"GDPR Article 32 (Security of Processing)":33,"NIST SP 800-53 AC-2 (Account Management)":34,"MITRE ATT&CK T1199 (Trusted Relationship)":35,"CIS Control 6 – Access Control Management":36,"NIST SP 800-161 (Supply Chain Risk Management)":37,"NIST SP 800-53 IA-5 (Authenticator Management)":38,"CIS Control 17 – Incident Response Management":39,"CIS Control 12 – Network Infrastructure Management":40,"NIST CSF PR.AC-1 (Identity and Credential Management)":41,"GDPR Article 33 (Notification of Personal Data Breach)":42,"NIST SP 800-53 SI-7 (Software, Firmware, and Information Integrity)":43,"ISO\u002FIEC 27001:2022 A.5.19 (Information Security in Supplier Relationships)":44},"Attackers used a valid credential to access tenants, the technique this entry describes.","Account management for privileged service credentials would limit the damage of a single compromised ConnectWise credential.","Assessing supply chain risk includes reviewing how MSPs protect credentials that reach customer tenants.","Least privilege limits what MSP backup credentials can access in customer tenants.","Securing third-party access to systems processing personal data is part of Article 32.","Account management ensures service accounts used by MSP tools are tracked and reviewed.","Abuse of the MSP's trusted access to customers is the technique this entry describes.","Access control management ensures a single credential cannot reach 173 tenants.","Supply chain risk management helps customers assess the risks of MSP tooling access.","Authenticator management requires protecting and rotating credentials used across many tenants.","Incident response helps MSPs and customers coordinate quickly when a shared credential is compromised.","Network infrastructure management can restrict where MSP tools connect from, limiting misuse.","Credential management helps ensure MSP credentials are strong, scoped and monitored.","Unauthorised access to customer tenants with personal data may require Article 33 notification.","Integrity monitoring helps detect unauthorised changes made through compromised MSP access.","Supplier relationship security requires agreeing controls with MSPs that hold privileged access.","published","2026-10-17T08:20:20.140391+00:00","2026-10-17T08:20:20.122+00:00",{"id":7,"url":49,"slug":50,"title":51},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhackers-use-compromised-connectwise.html","hackers-use-compromised-connectwise-credential-to-sign-in-to-173-microsoft-365-t-614eb3","Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants",[53,59,65],{"id":54,"name":55,"slug":56,"description":57,"color":58},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":60,"name":61,"slug":62,"description":63,"color":64},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":66,"name":67,"slug":68,"description":69,"color":70},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[72],{"id":73,"date":74,"edition":75,"title":76,"audio_url":77},"5bfd8efd-bbf0-427e-a12e-8abbb056097d","2026-10-17","afternoon","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-afternoon-brief-2026-10-17.mp3",[79,83,87],{"slug":80,"name":81,"problem":82},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":84,"name":85,"problem":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":88,"name":89,"problem":90},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached."]