Daily Cyber Threat Brief — October 18, 2026: ConnectWise Supply-Chain Attack Breaches Microsoft 365 Tenants

ConnectWise's cloud backup products protect customer data in Microsoft 365 and Google Workspace by operating through permissions customers grant in Microsoft Entra ID. Each backup integration is represented by a service principal — an application identity that holds whatever mailbox, file and Teams permissions the customer once approved. The attackers got hold of the application secrets behind ConnectWise Cloud Backup (the former SkyKick Cloud Backup) and, according to Todyl researchers, authenticated directly to Microsoft 365 as the backup application itself. Because the sign-ins were performed by an automated script with no user involved, multi-factor authentication was technically meaningless.

With those pre-granted permissions, the attackers could technically read and write mail and attachments, OneDrive and SharePoint files, and Teams chats in every tenant where the app was authorized. The forensic picture is mixed. Todyl examined nine tenants and found only sign-in activity — no accounts created, no permissions changed, no persistence planted through the backup app in those nine. Huntress saw a more aggressive pattern on nearly 50 tenants it monitors: service principals for ConnectWise's Cloud Management apps assigned themselves directory roles, mostly Exchange Administrator. In one tenant the attacker went further and established persistence in roughly five minutes: the Cloud Management – MS Teams app granted itself the Global Administrator role and added credentials to an MSP management tool and to Huntress's own application. Microsoft separately observed persistence via a backdoor after successful service-principal authentication, followed by Microsoft Graph API reconnaissance and attempts to add additional credentials.

ConnectWise shut down application access for partners and clients, but the company's shutdown removes nothing the attackers may already have planted inside customer tenants — and disabling an app stops new tokens without revoking existing ones. ConnectWise says it has no indicators that backup data itself was compromised and that the existing archive will be accessible once services are restored. The victim count and the extent of any data theft remain open, and how the attacker obtained the vendor's credentials is unknown. Huntress's practical guidance: disable the implicated ConnectWise applications, review secrets and certificates across all applications for unauthorized additions since October 13, and check service-principal sign-ins in Entra filtered by the Cloud Backup application ID (506e08f9-6e9a-4da4-942b-a099a03644ae).

Defender takeaway: application identities with standing directory permissions are privileged accounts with no MFA and no password expiry. Inventory every third-party service principal in your tenant, scope its permissions to the minimum, and alert on service-principal sign-ins from unexpected source IPs — that single Huntress-linked IP would have been the tell.

BeyondTrust disclosed on October 15 that its Remote Support product — the remote-access appliance formerly known as Bomgar — carried a critical zero-day scored 9.3 on CVSS v4. The flaw, CVE-2026-102764, is an improper origin validation in an internal messaging component that lets an unauthenticated attacker perform file operations on the appliance, escalating to full host control and access to every credential the appliance stores or brokers. All Remote Support versions up to and including 26.2.3 are affected; the fix shipped as patch BT26-05-RS for versions 24.3.1 through 26.2.3 on October 8, with SaaS instances remediated automatically by October 9.

The exploitation timeline is the alarming part. BeyondTrust says the flaw was first exploited on August 29 — against one BeyondTrust-hosted instance and one self-hosted appliance — and was only detected on September 28 during proactive threat hunting. The hosted instance was contained within 27 minutes of detection, but the zero-day sat in the wild for over a month before the patch. Mandiant and Google's Threat Intelligence Group attribute the campaign to ARMORY CASTLE, a suspected China-nexus espionage actor previously tracked as UNC5221, known for targeting SaaS providers, tech firms, government entities and legal services. The group's playbook after initial access: plant SAWFLY, an obfuscated PHP web shell with encrypted command traffic, escalate to root, attempt to dump the appliance's secrets vault through BeyondTrust's own tooling, deploy BARECLAW, a custom tunneling tool, delete logs, and reconfigure the web proxy to keep a durable path back in — including raising privileges on Jump Items to Administrator.

GTIG explicitly warns organizations to prepare for potential widespread exploitation now that the flaw is public. BeyondTrust is withholding technical details to protect unpatched customers — which means self-hosted administrators running exposed appliances should treat them as potentially compromised and hunt now.

Defender takeaway: remote-support appliances are credential brokers by design — owning one means owning a share of the keys to the network. Patch BT26-05-RS immediately, and if your appliance was internet-exposed before October 8, assume compromise and hunt for web shells, rogue proxy changes and unauthorized Jump Item privilege grants.

Fresh leak-site claims kept the extortion pipeline visible this weekend. On October 17, Ransomware.live reported that the Helix group listed Smith Douglas Homes — a US homebuilder with roughly $971 million in estimated annual revenue — publishing GoFile links and passwords set to unlock within 12 hours. On October 18 at 05:53 UTC, the N0n group listed a US-based biotech manufacturing firm as "Company #90," with the incident marked "pending exposure." Both claims remain unverified by the victims, and the reporting notes the now-familiar precursor pattern: infostealer infections — the Cavalier family was name-checked in the N0n context — frequently serve as the initial-access vector for ransomware operators.

The weekly numbers give the context. Between October 5 and 12, ransomware and extortion groups claimed 239 organizations across 40 countries — essentially flat against 237 the prior week, with a marked shift toward North America. The Gentlemen led with 43 claims, followed by Nightspire (24) and Qilin (23), while N0n reappeared with 18 after a quiet week. Three emerging brands — Vypr, Byod and Umbra — posted their first claims of 2026. As always, leak-site counts reflect only what groups choose to publish; the real incident volume is higher.

Defender takeaway: stealer-log credentials remain the cheapest path to ransomware. Continuously monitor infostealer feeds for your domains and treat any hit as a pre-ransomware indicator, not a low-priority credential leak.

Drupal patched two critical vulnerabilities on October 17 that allow remote code execution on websites running any supported version, and the project warned that exploits may emerge soon — patch now, not on the next cycle. Researchers are also warning that a maximum-severity flaw (CVE-2026-103849) in BlockStrap, affecting Magento and Adobe Commerce, could let attackers run code on storefront servers; the pattern of exploit code following fast after such disclosures makes immediate mitigation the sane bet. Palo Alto Networks warned on October 15 of a PAN-OS remote-code-execution flaw already exploited in attacks. And on the same day BleepingComputer reported attackers exploiting a Collabora RCE flaw to backdoor Nextcloud servers, alongside campaigns hijacking D-Link and Ubiquiti devices to resell victims' bandwidth.

The common thread with the BeyondTrust story above: internet-facing edge and application infrastructure remains the highest-yield attack surface. Inventory it, patch it in order of exposure, and instrument it for the first sign of post-exploitation behavior.

Defender takeaway: treat "exploited in the wild" advisories as incident-response triggers, not patch tickets — when a vendor says exploits may emerge soon, they already exist.