Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
Storm-0940 ConnectWise Supply Chain Attack: Detecting and Containing AI-Accelerated ScreenConnect Compromise Across 2,200+ Tenants
Introduction Microsoft Threat Intelligence has publicly attributed a large-scale ConnectWise supply chain attack to Storm-0940, a China-link...
ConnectWise Supply-Chain Attack: Defending Microsoft 365 Tenants Against Compromised API Secret Abuse
Introduction A supply-chain attack against ConnectWise — one of the most widely deployed MSP/TSP platforms in the managed services ecosystem...
ConnectWise Cloud Backup Security Incident: Credential Reset Guidance and Detection for MSP Environments
ConnectWise Resets Credentials as Cloud Backup Remains Offline ConnectWise disclosed a security incident involving unauthorized access to ap...
ConnectWise Cloud Backup Suspended After M365 Tenant Compromise — Hunting Malicious OAuth App Identities in Your Tenant
ConnectWise Suspends Cloud Backup After Application Identity Compromise ConnectWise disclosed on Saturday that unknown threat actors gained ...
ConnectWise Cloud Backup Supply-Chain Attack: Detecting and Remediating Compromised Microsoft 365 Tenants
ConnectWise Cloud Backup Supply-Chain Attack: What Happened and What You Must Do Now ConnectWise has shut down customer access to its Cloud ...
ConnectWise Cloud Backup Credential Compromise: 173 M365 Tenants Breached — Detection and Remediation Guide
Introduction Security researchers are tracking an active campaign in which unknown threat actors have abused a compromised Microsoft 365 cre...
ConnectWise ScreenConnect Under Active Exploitation: CISA-Confirmed Detection and Remediation Guide
Introduction CISA has confirmed what many of us in incident response have been watching build on the ground: a critical-severity vulnerabili...
Rogue ScreenConnect Clients Spread Four-Stage VBScript Worm: Detection and Remediation Guide
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts Threat actors are turning one of the most common legit...
TERMITE Ransomware: Cross-Border Healthcare Targeting & VPN Exploitation Surge
Threat Actor Profile — TERMITE Aliases: Termite Team, Termite Encryptor Operational Model: Emerging RaaS (Ransomware-as-a-Service) operator ...