[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBHAtDAYdRRlMNWXbrPQKvBde4GK6hobJqX78iwVuhJ0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":29,"status":30,"created_at":31,"published_at":32,"article":33,"tags":37,"podcasts":56,"controls":63},"e2d13cb3-a4b2-44e0-b543-28bda8d0eea6","connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","991bba8e-9c68-45b1-b9e6-88b7dc87e387","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","Attackers exploited compromised application identities (service principals) within ConnectWise's Cloud Backup service to gain unauthorized access to Microsoft 365 tenant environments, bypassing MFA entirely because the attack operated through trusted service-level credentials rather than user accounts. This highlights a critical blind spot in MFA strategies: machine-to-machine identities and service principals are often unprotected by the same authentication controls applied to human users. Once inside, attackers escalated privileges by assigning themselves administrative roles, demonstrating how a single compromised third-party integration can cascade into full tenant takeover. Supply-chain attacks of this nature are particularly dangerous because organizations implicitly trust their vendors' tools, often granting them broad permissions with little ongoing oversight.","**Immediate actions:**\n- Audit and revoke all unnecessary service principal permissions and OAuth application consents across your Microsoft 365 tenants immediately.\n- Review admin role assignments in Microsoft 365 for any unauthorized or unrecognized accounts added after October 15th.\n- Temporarily suspend or isolate third-party backup integrations until vendor remediation is confirmed and validated.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all service principals and application identities, granting only the minimum permissions required for each integration.\n- Establish a formal vendor risk management process that includes periodic reviews of third-party application permissions and security posture.\n- Implement Conditional Access Policies in Microsoft 365 to restrict service principal access by IP range, location, and behavioral baselines.\n\n**Detection measures:**\n- Enable and continuously monitor Microsoft 365 Unified Audit Logs for anomalous role assignments, privilege escalations, and unusual service principal activity.\n- Deploy SIEM alerting rules specifically targeting new Global Administrator or privileged role assignments originating from non-human identities.\n- Integrate Microsoft Entra ID (Azure AD) sign-in and audit logs into your SOC workflow to detect service principal abuse in near real-time.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 15 – Service Provider Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-9 (Service Identification and Authentication)","NIST SP 800-53 AU-6 (Audit Record Review and Analysis)","NIST SP 800-53 SA-9 (External System Services)","NIST CSF ID.SC-4 (Supply Chain Risk Management)","NIST CSF PR.AC-4 (Access Permissions Management)","ISO\u002FIEC 27001 A.9.2 – User Access Management","ISO\u002FIEC 27001 A.15.1 – Information Security in Supplier Relationships","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","MITRE ATT&CK T1098.003 – Account Manipulation: Additional Cloud Roles",{},"published","2026-10-17T16:20:21.561336+00:00","2026-10-17T16:20:21.545+00:00",{"id":7,"url":34,"slug":35,"title":36},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack\u002F","hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack-622bd9","Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack",[38,44,50],{"id":39,"name":40,"slug":41,"description":42,"color":43},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":45,"name":46,"slug":47,"description":48,"color":49},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":51,"name":52,"slug":53,"description":54,"color":55},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[57],{"id":58,"date":59,"edition":60,"title":61,"audio_url":62},"f11b3a67-3f7a-4470-8f85-93100bc16c1b","2026-10-18","morning","ThreatNoir Weekend Brief — October 18","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-18\u002Fthreatnoir-morning-brief-2026-10-18.mp3",[64,68,72],{"slug":65,"name":66,"problem":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":69,"name":70,"problem":71},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":73,"name":74,"problem":75},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed."]