Posts Tagged ‘Microsoft 365’
ConnectWise Supply Chain Attack Hits Microsoft 365
The ConnectWise supply chain attack now has a name behind it. Microsoft assesses that the China state-aligned group Storm-0940 used stolen credentials of ConnectWise cloud applications to sign in to customer Microsoft 365 tenants, with AI agents doing the work. Disabling the ConnectWise connection may not be enough, because the attackers could have added credentials…
Read MoreConnectWise Cloud Backup Incident and Microsoft 365
In mid-October, Huntress and Microsoft reported that attackers had abused a compromised vendor-side credential associated with ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. ConnectWise confirmed unauthorized access to its Cloud Backup application identities and took containment measures. Many managed service providers (MSPs) use Cloud Backup to copy their clients’…
Read MoreDevice Code Phishing: What SMEs Need to Know
Cybercriminals have started exploiting a login shortcut millions of people already trust. Rather than sending victims to a fake login page or trying to steal a password outright, they persuade employees to authorise an attacker-controlled device through a completely legitimate identity provider — Microsoft, most often. The result is a fast-growing form of social engineering…
Read MoreAzure CLI Password Spray Bypasses MFA
An Azure CLI password spray campaign made more than 81 million login attempts against Microsoft accounts over two weeks and successfully compromised 78 accounts across 64 organizations — a meaningful share of which believed multi-factor authentication already protected them. The attackers did not break MFA. They found a legacy authentication path that most Conditional Access…
Read More