[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f28oik1gnxorqa":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":61,"author":73,"related":76},"attackers-used-connectwise-cloud-backup-app-identities-to-get-into-microsoft-365-tenants","Attackers Used ConnectWise Cloud Backup App Identities to Get Into Microsoft 365 Tenants","Attackers abused application identities from ConnectWise Cloud Backup, formerly SkyKick, to sign in to customer Microsoft 365 tenants. ConnectWise has suspended the service. MSPs need to disable the apps in every tenant and hunt for added credentials.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fconnectwise_cloud_backup_advisory.png","2026-10-20T16:00:00.000+08:00",[63],{"key":64,"label":65},"security","Security",5,"\u003Cp>A backup service is trusted with nearly everything in a Microsoft 365 tenant: mail, files and Teams chats. That trust is what attackers turned against managed service providers and their customers this past week. ConnectWise says it \"identified unauthorized access to application identities\" tied to ConnectWise Cloud Backup, the service formerly known as SkyKick, and has suspended it while it investigates, according to its \u003Ca href=\"https:\u002F\u002Fwww.connectwise.com\u002Fcompany\u002Ftrust\u002Fadvisories?ref=ghost.jdneer.com\">Trust Center advisory\u003C\u002Fa>.\u003C\u002Fp>\u003Cp>As of the advisory's latest update on October 20 (00:45 UTC, 8:45 AM Manila), Cloud Backup, SaaS Security and Cloud Management remain suspended, and scheduled backups, archive access and restores are still unavailable. ConnectWise says it is resetting accounts and replacing application credentials in the affected environment, plans to restore services \"in controlled phases,\" and will give partners \"clear instructions\" before anything is re-enabled. There is no restoration date yet; the company says it \"will share restoration timing as soon as it is confirmed.\" It also says that since mitigations began on October 17 at 05:00 UTC, it has \"not observed successful threat activity in the environments we monitor,\" though that \"does not establish whether individual partner or customer Microsoft 365 tenants have been affected.\"\u003C\u002Fp>\u003Ch2 id=\"what-happened\">What happened\u003C\u002Fh2>\u003Cp>Huntress, which first raised the alarm on October 16, said in its \u003Ca href=\"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fvendor-credential-enables-unauthorized-access?ref=ghost.jdneer.com\">analysis\u003C\u002Fa> that a Microsoft 365 credential (an API secret) belonging to ConnectWise Cloud Backup had been compromised and was being used to access customers' Microsoft 365 environments. Because these sign-ins happen as an application, not as a user, multi-factor authentication does not come into play; the attacker inherits whatever permissions the customer already granted the backup app.\u003C\u002Fp>\u003Cp>According to Huntress, the backup app's identity signed in to customer tenants from \u003Ccode>144.172.64[.]128\u003C\u002Fcode>, a hosting provider address, on October 15 between 06:13 and 08:34 UTC and received Microsoft Graph tokens, moving through tenants a few seconds apart in a way that \"points to a script working from a target list.\" Legitimate traffic from the app comes from Azure private IP space. As of 19:00 UTC on October 16, Huntress said it had confirmed unauthorized sign-ins in 162 tenants. In an October 17 update, it added that almost 1,000 Entra tenants showed sign-in activity from that address, with over 300 succeeding, although sign-ins failed to gain access where the ConnectWise service principal was not present.\u003C\u002Fp>\u003Cp>A second ConnectWise app was involved too. Huntress saw Cloud Management service principals assign themselves directory roles, mostly Exchange Administrator, in roughly 50 tenants it monitors. In one customer tenant, ConnectWise Cloud Management - MS Teams (application ID \u003Ccode>24205314-2b89-4e07-a2a4-579e898a5640\u003C\u002Fcode>) added itself to the Global Administrator role at 03:44 UTC on October 15 and then added new client secrets to two other applications, an MSP management app and Huntress's own app. In an \u003Ca href=\"https:\u002F\u002Fwww.huntress.com\u002Fblog\u002Fvendor-credential-enables-unauthorized-access?ref=ghost.jdneer.com#:~:text=Update%3A%2010%2F19%2F26\">October 19 update\u003C\u002Fa>, Huntress reported the same pattern in a second tenant: the application granted itself Global Administrator, then planted a new secret on a small number of other applications, with the activity in both tenants taking place within two minutes of each other around 03:45 UTC on October 15. In the two tenants it reviewed, Huntress says it \"found no evidence of mailbox or file manipulation, or user or policy changes,\" though it cautions that the access may have been used for Microsoft Graph directory reads, which leave no audit record. That happened about two and a half hours before the first sign-ins from \u003Ccode>144.172.64[.]128\u003C\u002Fcode>, and Huntress says it has not tied the two phases to the same operator. It advises disabling both the Cloud Backup app and the MS Teams app immediately, and considering the other Cloud Management IDs as well.\u003C\u002Fp>\u003Cp>ConnectWise says it disabled seven application identities and revoked their credentials at 07:00 UTC on October 17, per its \u003Ca href=\"https:\u002F\u002Fwww.connectwise.com\u002Fcontentassets\u002F10777cd3364d440c86ed5270a94a5f24\u002Fconnectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf?ref=ghost.jdneer.com\">technical investigation and remediation guide\u003C\u002Fa>. The same guide warns that those vendor-side actions \"do not change the configuration of enterprise applications within individual partner or customer tenants,\" and that \"previously issued tokens may remain usable until they expire.\" On the backups themselves, ConnectWise's October 18 update (01:00 UTC) says existing archives \"remain encrypted, isolated, and preserved\" and that it has \"no evidence that these archives have been accessed.\" Its October 20 update again describes the archives as encrypted, isolated and preserved, \"with no indication that they have been compromised.\" The company adds that this finding covers stored backup archives and does not establish whether any individual live Microsoft 365 environment was affected.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>If you, your MSP or any customer tenant you manage ever connected SkyKick or ConnectWise Cloud Backup or Cloud Management, assume you need to check, even if the connection has been dormant for years. ConnectWise's guide lists these application IDs; match on the ID, not the display name:\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Application\u003C\u002Fth>\u003Cth>Application ID\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\n\u003Ctr>\u003Ctd>Cloud Backup\u003C\u002Ftd>\u003Ctd>\u003Ccode>506e08f9-6e9a-4da4-942b-a099a03644ae\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>Cloud Management\u003C\u002Ftd>\u003Ctd>\u003Ccode>2399d300-6fca-4e6a-a686-399fefe75b83\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>CM - MS Teams\u003C\u002Ftd>\u003Ctd>\u003Ccode>24205314-2b89-4e07-a2a4-579e898a5640\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>CM - Exchange Online\u003C\u002Ftd>\u003Ctd>\u003Ccode>b78f6a77-d4e5-46fb-87e5-d1648bd02519\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>CM - MS Graph\u003C\u002Ftd>\u003Ctd>\u003Ccode>0de14c77-b9b0-4137-9360-34878a929827\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>CM - Partner Center\u003C\u002Ftd>\u003Ctd>\u003Ccode>412dcf96-176d-4b3a-a1b0-4981ad66971e\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003Ctr>\u003Ctd>CM - SharePoint Online\u003C\u002Ftd>\u003Ctd>\u003Ccode>b2b55f5b-7758-4719-8d8f-88ae172e6bdb\u003C\u002Fcode>\u003C\u002Ftd>\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cul>\u003Cli>\u003Cstrong>Preserve logs first, or in parallel.\u003C\u002Fstrong> Export Entra audit logs and all sign-in categories (interactive, non-interactive, service principal, managed identity) as JSON, plus Microsoft Purview audit data. ConnectWise notes Entra keeps these for only 7 days on Free and 30 days on P1\u002FP2.\u003C\u002Fli>\u003Cli>\u003Cstrong>Review sign-ins from October 13 onward.\u003C\u002Fstrong> Filter every sign-in category on the IP \u003Ccode>144.172.64.128\u003C\u002Fcode>, which ConnectWise lists alongside \u003Ccode>144.172.64[.]99\u003C\u002Fcode> and \u003Ccode>144.172.64[.]60\u003C\u002Fcode>, and filter service principal sign-ins on each application ID.\u003C\u002Fli>\u003Cli>\u003Cstrong>Look for persistence.\u003C\u002Fstrong> In audit logs, check ApplicationManagement events (new credentials, owners, app role assignments, consent), RoleManagement changes, Conditional Access changes and new users. Huntress stresses that disabling the apps \"will not remove credentials that were already added,\" so review credentials on all of your applications, not just ConnectWise's.\u003C\u002Fli>\u003Cli>\u003Cstrong>Keep the apps off.\u003C\u002Fstrong> Do not re-enable them until ConnectWise gives formal restoration instructions.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Check for unexpected admin roles.\u003C\u002Fstrong> Huntress advises checking Entra audit logs for ConnectWise or SkyKick applications adding themselves to a directory role, which appears as an \"Add member to role\" event, and removing any role you did not intentionally grant, especially Global Administrator or Privileged Authentication Administrator, once the app is disabled. Separately, it advises auditing all service principal sign-ins to the affected apps from around 01:00 UTC on October 15 to 02:00 UTC on October 16. With Microsoft Graph PowerShell:\u003C\u002Fp>\u003Cpre>\u003Ccode>Connect-MgGraph -Scopes \"AuditLog.Read.All\"\n$f = \"activityDisplayName eq 'Add member to role'\" +\n  \" and activityDateTime ge 2026-10-13T00:00:00Z\"\nGet-MgAuditLogDirectoryAudit -All -Filter $f |\n  Select-Object ActivityDateTime, Result,\n    @{n='By';e={$_.InitiatedBy.App.DisplayName}},\n    @{n='Target';e={$_.TargetResources[0].DisplayName}}\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>An application, not a person, showing up as the initiator is the pattern to chase.\u003C\u002Fp>\u003Cp>\u003Cstrong>Find the apps and disable them, do not delete them.\u003C\u002Fstrong> In the Entra admin center, go to Enterprise applications, All applications, open each ID, and set \"Enabled for users to sign-in?\" to No. With Microsoft Graph PowerShell, the check for one ID looks like this:\u003C\u002Fp>\u003Cpre>\u003Ccode>Connect-MgGraph -Scopes \"Application.ReadWrite.All\"\n$sp = Get-MgServicePrincipal `\n  -Filter \"appId eq '506e08f9-6e9a-4da4-942b-a099a03644ae'\"\n$sp | Select-Object DisplayName, AccountEnabled, Id\nUpdate-MgServicePrincipal -ServicePrincipalId $sp.Id `\n  -AccountEnabled:$false\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Repeat for each ID in the table. ConnectWise and Huntress both say to disable rather than delete, so configuration and evidence are preserved.\u003C\u002Fp>\u003Cp>For MSPs, the uncomfortable lesson is one that management-plane attacks keep teaching: the tools that manage many customers at once are the most valuable keys you hold. Inventory the third-party apps with standing permissions in every tenant, and remove the ones nobody uses anymore.\u003C\u002Fp>","Attackers abused application identities from ConnectWise Cloud Backup, formerly SkyKick, to sign in to customer Microsoft 365 tenants. ConnectWise has...",{"src":60,"width":70,"height":71,"type":72},1600,900,"image\u002Fpng",{"name":74,"url":75,"owner":13},"Aiko Tanaka",null,[77,89,100,111],{"slug":78,"title":79,"excerpt":80,"image":81,"publishedAt":82,"topics":83,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[84,87],{"key":85,"label":86},"advisories","Advisories",{"key":64,"label":65},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":64,"label":65},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":64,"label":65},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]