Attackers stole ConnectWise application credentials to access Microsoft 365 tenants, prompting the company to suspend cloud services. ConnectWise suspended its Cloud Backup service and took both SaaS Security and Cloud Management offline over the weekend after discovering that unknown attackers had obtained unauthorized access to seven of its application identities. The company discovered the incident on October 14 through internal monitoring, disabled the compromised identities on October 17, and is still investigating how attackers obtained the credentials. “We have taken protective action following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick. Our investigation remains ongoing. Since implementing the mitigations described below, we have not observed successful threat activity in the environments we monitor.” reads the alert published by the company on October 17. “Out of an abundance of caution, we suspended Cloud Backup service by revoking certificates used for affected application connections across all users. This removed ConnectWise’s access through those connections. The shared credentials previously used for Cloud Backup are no longer valid and cannot be used. In addition to mobilizing our internal security teams and Security Operations Center (SOC), we have engaged a reputable third-party incident response firm to support our investigation and containment efforts. Together, these teams are actively monitoring our backup infrastructure and broader environment, with the investigation extending across all partner-facing services. At this time, we have no indication that any other ConnectWise product, service, or offering is impacted.” This was not a case of attackers stealing individual customers’ passwords. ConnectWise’s applications already had permission to access customer Microsoft 365 environments to manage services and run backups. After stealing the application credentials, the attackers could pretend to be ConnectWise’s own applications and request access tokens from Microsoft Entra ID. They did not need to steal any customer passwords. Depending on the permissions granted to these applications, the attackers could access mailboxes, SharePoint documents, Teams messages, and directory data. ConnectWise explained that disabling the affected connections prevents new authentication through those connections; however, it does not reverse changes previously made inside a tenant. In other words, disabling the compromised connections stops new access through them, but it does not undo what the attackers may have already done inside customer environments. Any changes made before the connections were disabled may remain. Here’s what makes this particularly hard to clean up. An attacker who used a stolen application credential to get into a tenant could add their own client secret to a different trusted application already registered in that tenant, or create an entirely new application and grant it permissions. Either path gives them a second key that still works even after ConnectWise’s original compromised credential is revoked. “The larger risk is what happens when that access is used to gain more. If an application can assign directory roles, as we saw in one tenant, it can make itself a Global Administrator, and an administrator can add credentials to other applications, create new applications and grant them permissions, reset passwords and authentication methods for users, and change Conditional Access policies.” reads the analysis published by cybersecurity firm Huntress. “Each of those steps gives the attacker another way back in that does not depend on the original vendor credential, which is why rotating the vendor credential is necessary, but not enough.” Huntress identified malicious sign-ins from IP address 144.172.64.128 through October 15 at around 14:20 UTC, and a second targeted wave later that same day aimed specifically at 16 tenants in the policy, national security, trade, and critical minerals sectors. That second wave appeared to be manual rather than automated and hit Exchange Online, SharePoint Online, Teams, Azure Resource Manager, Entra, and Office 365 Management APIs in rapid succession. All 16 attempts in the second wave failed, but the fact that they were manually targeted at sensitive sectors is the detail worth sitting with. Of about 1,000 Microsoft Entra tenants that recorded sign-in activity from the suspicious IP address, around 300 sign-ins were successful. However, a successful sign-in did not always give the attackers access to a tenant. In some cases, they could not proceed because the required service principal was missing. This was a result of the tenant’s configuration, not a security measure that had been deliberately put in place. ConnectWise said its Cloud Backup archives remain encrypted, isolated, and preserved, with no evidence that attackers accessed or compromised them. “Cloud Backup remains suspended. Scheduled backups are not running, and access to affected backup archives and restoration capabilities remains unavailable.” continues the ConnectWise’s alert.”Existing archives remain encrypted, isolated, and preserved. We have no evidence that these archives have been accessed.” However, while the service remains offline, backups cannot run and customers cannot restore their data. This creates an operational risk for organizations that depend on the service to recover their systems and information. Huntress’s recommendation for anyone using ConnectWise Cloud Backup or Cloud Management is to review both their own Microsoft 365 tenant and every managed customer tenant, including any with dormant SkyKick connections. Look specifically for sign-in activity from 144.172.64[.]128 starting October 13. Before doing anything else, preserve available sign-in and audit logs, because containment steps can overwrite the evidence you need to understand what actually happened. The list of what to check is long: application credentials and federation trusts, directory role assignments, consent grants, recent policy changes, mailbox forwarding rules, and delegated mailbox access. Any of these could be the thing an attacker quietly added before the connection was killed. Full ConnectWise advisory and ongoing updates are available here. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ConnectWise)
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. In a new Windows release health dashboard update over the weekend, Microsoft said users may have trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later. In some cases, affected customers are also reportedly seeing Exchange Server OWA failing with a "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" error and Event ID 1006 in the application log. "After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," it said.
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process. As of October 15, 2026, none of the affected devices in Belgium had received a patch. “A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.” The vulnerability affects the WPS EAP reassembly code, which handles part of the wireless setup process used by many consumer routers. An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user. The attack can expose information and allow the attacker to run code on the router. In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection. He then used the password to connect to the network. These attacks are not just theoretical. Kaiser demonstrated working exploits against two devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. Both allowed an attacker to run code without authentication. In one demonstration, the attacker opened a reverse shell using only Wi-Fi frames, without needing a command server accessible over the internet. The attack can work from a distance. The close antenna placement shown in the video was only for the laboratory setup and is not a requirement for the attack. In the video below, Kaiser exploited an Orange Belgium router (ASKEY TCG3000). The attack allowed him to run code on the device without authentication. The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi. He then used the stolen password to connect to the network, confirming that the exploit works and that the password is correct. Do not be misled by how close the antenna is in the video. The attack can work over much longer distances. In the next video, the researcher exploited a Proximus router (BBOX3V+, also known as Sagemcom F@st). This attack also allows code execution without authentication. He used it to open a reverse shell over Wi-Fi frames, without needing a command-and-control (C2) server hosted in the cloud. Broadcom quietly released an incomplete fix in 2018, then told customers to migrate to a different software stack entirely rather than shipping a complete patch for their own code. On eCos-based platforms, covering chipsets like BCM3380, BCM3383, and BCM33834, that makes this a permanent unfixable bug by design. On Linux-based platforms (BCM3390, BCM65xx, BCM68xx) the situation depends entirely on whether individual manufacturers decide to act. Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him to ask the affected device manufacturers to contact Broadcom directly. The company refused to assign a CVE or share the notification it had sent through its customer portal. CERT/CC opened a case but closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. This was not a proper disclosure process. It was a dead end, with a paper trail. Kaiser’s rough calculation, done with Belgian telecom market data, puts the affected device count at around 850,000 for Proximus, 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium, totalling somewhere north of 1.5 million potentially exposed gateways in one small country. Telenet may also be affected through Sagemcom devices but Kaiser couldn’t confirm because he couldn’t get hold of one. The affected manufacturers sell into markets well beyond Belgium. The chipsets in question appear in devices across dozens of vendors and hundreds of products worldwide. Kaiser is publishing a fingerprinting script and a YARA rule specifically to help map the full scope of affected deployments, because right now nobody has a complete picture. A vulnerability introduced in 2010 and only partly fixed in 2018 still affects routers in use today. Kaiser says AI-assisted analysis helped him find the bugs in less than a week, instead of months. This can help defenders find vulnerabilities faster, but attackers can do the same. The risk is greatest in targeted attacks where an attacker is within Wi-Fi range, such as hotel network attacks or surveillance of nearby targets. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. Most users and security teams rarely check the firmware on ISP-provided routers. “Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week.” Kaiser concludes. “Which is a good thing because we can start looking into deeper and deeper layers of our technical infrastructure for a fraction of the cost.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Broadcom Wi-Fi)
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
Confirm this action.
Leaving now will discard your changes.