5 casos · pág. 1/1
An active supply chain attack is abusing a compromised credential for the ConnectWise Cloud Backup (formerly SkyKick) Microsoft 365 OAuth application, giving unknown actors access to customer tenants. Huntress confirmed unauthorized sign-ins in 173 partner/customer tenants, and Microsoft reports broad successful service principal authenti…
Unknown threat actors breached the TeamUpdraft website on 17-18 October 2026 and likely accessed its customer database, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack observed an attacker holding valid UpdraftCentral dashboard keys issuing signed commands to install backdoor plugins on connected …
ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed alm…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
