Edition 04

One vendor credential, hundreds of M365 tenants

19 Oct 20265 stories4 min read3:54 listen

Plus an espionage zero-day in BeyondTrust, root-by-email on Cisco gateways, and a poisoned WordPress plugin.

Listen · 3:54Download PDF

Listen to this edition.

Narrated using an AI voice.

Download MP3 Follow the podcast

Read the transcript

Kia ora, welcome to It's probably nothing for the 19th of October. A heavy few days, so this one's a bit longer.

The lead: ConnectWise has confirmed an API secret for Cloud Backup — the old SkyKick — was compromised. The app is consented into every customer tenant with read-write access to mail, files, chats and directory data. Huntress watched its identity sign in from a rented hosting IP on the 15th, walking tenants in sorted GUID order seconds apart. It confirmed unauthorised sign-ins in 162 tenants; a day later, almost a thousand touched, more than 300 successfully. A second, targeted wave hit 16 tenants in policy, national security, trade and critical minerals, most not ConnectWise customers. In one tenant, a second ConnectWise app granted itself Global Administrator and added credentials to two other apps — Huntress's own among them. Cloud Backup and two related services remain suspended. Microsoft, via BleepingComputer, calls it an active supply-chain attack. Data theft's unconfirmed — app reads barely log, so nothing visible isn't nothing taken. If you've got these apps consented: disable, don't delete; audit any credentials added since the 13th, and keep them off until ConnectWise confirms rotation. How the credential escaped is still under investigation.

Mandiant says ARMORY CASTLE, the suspected PRC-nexus espionage actor, exploited a BeyondTrust Remote Support zero-day from late August. It's a 9.3 on every supported version: unauthenticated file operations becoming host control of a box whose job is brokering other people's credentials. Mandiant found a webshell called Sawfly, a setuid-root backdoor, credential-vault dumps and sudoers persistence surviving reboots and config resets, then pivots through the app itself using stolen admin credentials. CISA added it to the known-exploited catalogue on the 16th with forensic triage attached; the federal due date is today. Patching alone won't clear a compromised appliance, and customers can't audit the host filesystem — so anything internet-reachable on a vulnerable version since August is potentially compromised: rebuild from known good, rotate everything it ever held. Attribution is Mandiant's, the vendor timeline SecurityWeek's.

Cisco's email gateway bug is the neatest: a 9.8 in the Secure Email Gateway where a crafted attachment — with AMP file reputation on and the scanner tools out of date — lands file writes and command execution as root on the box that scans the email. Cisco became aware of active exploitation this month. The fix is a scanner-tools update, no restart; the KEV deadline was the 17th. Root means the device's logs can lie, so cross-check external network logs.

Shorter: BleepingComputer reports a command injection in SiteGuard's Server Edition WAF's default-on statistics feature is being exploited to run commands as root or SYSTEM. SiteGuard confirms abuse and JPCERT/CC warns likewise; it says patching can erase attack traces, so pull diagnostics first. Single-source so far — BleepingComputer quoting the two advisories.

Finally, a WordPress one: some Rank Math SEO PRO downloads carried malware for eleven hours — 8pm UTC on the 15th to 7am on the 16th. The malware recreates hidden backdoors on page visits and exposes every secret the web server can reach. A clean release is out, scored 9.8. The version alone doesn't damn you — only packages from that window — but an activated copy means treating the site as compromised; updating doesn't evict anything planted. Wordfence's page was erroring, so the details are via a repost; download numbers aren't public.

That's the lot — catch you next time.

Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat.

The takeaway

A heavy window, so this runs longer than usual. The lead: a stolen credential for ConnectWise's Microsoft 365 backup app has been signing into customer tenants at scale. Also inside: an espionage actor's BeyondTrust zero-day, an exploited Cisco email gateway, and two short ones.

A ConnectWise backup credential signed into hundreds of Microsoft 365 tenants

ConnectWise has confirmed that an API secret for Cloud Backup — the former SkyKick, an app consented into every customer tenant with read-write access to mail, files, chats and directory data — was compromised. Huntress watched the app's identity sign in from a rented hosting IP on 15 October, walking tenants in sorted GUID order seconds apart: a script working a list, basically. It confirmed unauthorised sign-ins in 162 tenants on 16 October; a day later it counted almost 1,000 tenants touched from that IP, more than 300 successfully. A second, targeted wave hit 16 tenants in policy, national-security, trade and critical minerals, most not ConnectWise customers. In one tenant, a second ConnectWise app granted itself Global Administrator and added credentials to two other applications, Huntress's own among them. Cloud Backup and two related services remain suspended, with no restore time given.

Microsoft, via BleepingComputer, calls it an active supply-chain attack. Data theft is unconfirmed because app reads barely log, so Huntress's 'tokens issued, nothing visible taken' is not the same as nothing taken.

Worth asking

If you run tenants with ConnectWise or SkyKick apps consented: disable (don't delete) them, audit credentials added to any application since 13 October, and keep them off until ConnectWise confirms rotation. Issued tokens stay valid up to 90 minutes after disabling, so the switch isn't instant.

How the credential escaped in the first place is still under investigation.

Sources 5

ARMORY CASTLE had a BeyondTrust zero-day in August, and patching alone won't clear it

Mandiant says ARMORY CASTLE — the suspected PRC-nexus espionage actor formerly tracked as UNC5221 — exploited CVE-2026-102764 in BeyondTrust Remote Support as a zero-day from late August. It's a CVSS 9.3 affecting every supported version up to 26.2.3: unauthenticated file operations on the appliance, becoming host-level control of a box whose job is storing and brokering other people's credentials. Investigators found a webshell called SAWFLY, a SUID-root backdoor, dumps of the appliance credential vault and sudoers persistence that survives reboots and config resets, then a pivot through the Remote Support app itself with stolen admin credentials. CISA added it to KEV on 16 October with forensic triage attached; the federal due date is today.

Patching alone doesn't clear a compromised appliance, and customers can't audit the host filesystem. Mandiant warns mass exploitation may now follow disclosure, as it saw after this actor's Ivanti zero-days in 2024.

Worth asking

Anything internet-reachable on a vulnerable version since August is potentially compromised: rebuild from known good and rotate everything the appliance ever held.

The attribution is Mandiant's, and the vendor timeline (exploited 29 August, patch shipped 8 October) comes via SecurityWeek.

Sources 4

Cisco's email gateway bug delivers root by email

CVE-2026-76519, CVSS 9.8, has the week's most pointed delivery path: email a crafted attachment through a Cisco Secure Email Gateway and, if AMP file reputation is on and Content Scanner Tools is older than 25.3.0.5525, you get arbitrary file writes and command execution as root on the box that scans the email. Cisco's PSIRT became aware of active exploitation in October; the bug surfaced in internal scanning. The fix is a Content Scanner Tools update with no restart, though the KEV deadline was 17 October, already gone.

Worth asking

Root means the device's logs can lie, so cross-check external network logs; Cisco also wants cluster members that shared SSH keys with a compromised box rebuilt, and says it has contacted Secure Email Cloud customers whose devices showed possible indicators.

Sources 3

SiteGuard WAF command injection under active exploitation

BleepingComputer reports CVE-2026-106931, a command injection in the default-on statistics feature of SiteGuard's Server Edition WAF, is being exploited to run commands as root or SYSTEM. SiteGuard's bulletin confirms abuse and JPCERT/CC warns likewise. The vendor says patching may erase attack traces, so pull the diagnostic information first.

Single-source so far: everything rests on BleepingComputer quoting the two advisories; neither was read directly.

Sources 1

Hackers exploit SiteGuard WAF flaw to run commands as admins (BleepingComputer)

Some Rank Math SEO PRO downloads carried malware for eleven hours

Some Rank Math SEO PRO 3.0.123 packages downloaded or auto-updated in an eleven-hour window — 20:02 UTC on 15 October to 07:12 on the 16th — carried malware that recreates hidden backdoors on page visits, phones home to rank1cdn[.]com and exposes every secret the web server can reach. Clean 3.0.124 is out and the bug is CVE-2026-111862, 9.8. The version alone doesn't damn you (only packages from that window, which Rank Math says it can identify), but an activated copy means treating the site as compromised — updating doesn't evict anything already planted.

Wordfence's own page was erroring when checked, so details come via a full repost, and affected download numbers aren't public.

Sources 2

See you tomorrow.

Read online, listen in your podcast app, or get the daily email.

Choose how to follow IPN →