[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGJCuVA3o4Smt829j4f4KqnEXLEIbn2eWVvp3b2Pk1Bc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"f7dbaa44-15f8-4db8-a71a-447a81e3683f","connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","fd42b41e-f01a-4845-bf72-d236b0585485","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","Threat actors gained unauthorized access to ConnectWise application identities, enabling them to compromise Microsoft 365 tenants relying on the platform's cloud backup service. This incident highlights the cascading risk of compromised service application identities — when a trusted integration is hijacked, attackers inherit broad access to connected customer environments. The decision to suspend the cloud backup service underscores how a security incident in a managed service provider can simultaneously impact many downstream organizations. Businesses depending on third-party backup solutions must understand that their data protection posture is only as strong as their provider's security controls.","**Immediate actions:**\n- Audit and rotate all application identity credentials and OAuth tokens connected to Microsoft 365 tenants immediately.\n- Disable or revoke any third-party application identities that are not actively verified as secure and necessary.\n- Enable Microsoft 365 audit logging to detect unauthorized access or anomalous application activity across all tenants.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all third-party application integrations, limiting permissions strictly to what is required for functionality.\n- Implement a vendor risk management program that continuously evaluates the security posture of all managed service providers and cloud integrations.\n- Maintain offline or geographically separated backup copies independent of any single cloud provider or managed service to ensure recoverability during provider-side incidents.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting for unusual application identity activity, including unexpected consent grants or token issuances in Microsoft 365.\n- Establish a formal incident response playbook specifically for third-party service compromises, including predefined criteria for service suspension and tenant isolation.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IR-4: Incident Handling","NIST CP-9: System Backup","NIST SA-9: External System Services","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ISO 27001 A.12.3: Information Backup","ISO 27001 A.15.2: Supplier Service Delivery Management",{},"published","2026-10-18T10:20:20.498569+00:00","2026-10-18T10:20:20.475+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fconnectwise-suspends-cloud-backup-after.html","connectwise-suspends-cloud-backup-after-attackers-compromise-microsoft-365-tenan-1a74dd","ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":41,"name":42,"slug":43,"description":44,"color":45},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":47,"name":48,"slug":49,"description":50,"color":51},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"bb926e2e-b48f-4dee-ada0-615579680dd0","2026-10-18","afternoon","ThreatNoir Weekend Brief — October 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-18\u002Fthreatnoir-afternoon-brief-2026-10-18.mp3",[60,64,68],{"slug":61,"name":62,"problem":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":65,"name":66,"problem":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":69,"name":70,"problem":71},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files."]