Bits, Bytes, and Bourbon @DecryptedTech

@ZackKorman @cheddar420yolo No, but we are looking into requiring DNA proof of identity via blood. Anytime you connect you need to tap a vein to run your device... We think it has a simple elegance to it... </of course this is a joke> Tag for the humor impaired.

@infosec_fox @ZackKorman It is 8:14 PM my time. Not time for bed yet, for me at least.

@infosec_fox @ZackKorman They do not want any accountability. That has been clear for a while.

@ZackKorman @infosec_fox Hahaha... no just a long winded sarcastic run up to the real point ;-)

@ZackKorman @Mayhem4Markets We got organized for the SOPA and PIPA events. We can do it again.

@DRich330 Damn, I wasn't invited :(

Seems OpenCode customers getting notices of a breach. Got some DMs that people’s API keys are running up charges. Not seeing it on the news yet. Anyone else?

This is the multitenant risk in plain sight. Customers granted Directory.ReadWrite.All because the backup app needed it to work, and that trust became the attack surface. No one did anything wrong; the permissions were legitimate, which is what makes it so effective. The backdoor step is the one to watch. Adding credentials to the service principal means revoking app consent isn't enough. You have to find and remove the credentials the attacker added, or they can come back after the cleanup. Worth checking every tenant that ever consented to this AppId, not just the ones that show the IP.

Microsoft Threat Intelligence @MsftSecIntel

21 hours ago

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens

5 79 235 24K 130

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants. ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All. On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities. We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV. Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

Well, shit. ConnectWise is confirming that they're investigating potential unauthorized access to Cloud Backup - which contains O365 and Entra data for all the orgs that an MSP is backing up using that system. status.connectwise.com There goes the weekend.

The current MSSP incident reported by Huntress is a good reminder why you should enable app instance property lock for your applications to prevent malicious takeover in a compromised customer tenant. huntress.com/blog/vendor-cr… learn.microsoft.com/en-us/entra/id…

Well,... shit. Things like this are never good when they happen. It feels like each incident like this is something that should have been caught with a good development and deployment workflow along with proper risk and exposure modeling.

Huntress @HuntressLabs

14 hours ago

UPDATE: We have high-confidence the threat actor has also abused these ConnectWise Cloud Management apps: -Exchange Online (b78f6a77-d4e5-46fb-87e5-d1648bd02519) -MS Teams (24205314-2b89-4e07-a2a4-579e898a5640) -SharePoint Online (b2b55f5b-7758-4719-8d8f-88ae172e6bdb)

2 11 25 3K 6

If you have a vendor with a compromised application secret, it is wise to disable the app. The cost and damage from what will occur if you don't is more.

@uwu_underground But this one goes to 11.

This is huge for more reasons than one! Windows 11 Build 26340.9750 (Insider Experimental Preview) adds hybrid join support for the web sign-in provider It also allows for use of passkeys from phones 🤯 We finally have a simple, unified login provider for shared devices!

💫 @RowanSaintLouis

a day ago

@NathanMcNulty oh boy. I can't wait to see this preview feature hit GA 😍 i've been waiting on this for a hot minute

2 3 20 7K 16

'I Read The Policies So You Don't Have To' Part 4 Anthropic, Claude (Artificial Intelligence) Happy Tuesday medium.com/@ItsNotNicole/…

@gabsmashh So you ordering a Pangalactic Gargleblaster?

THIS. Every week, one of us on blue team reports active threat actors using Cloudflare's tunnels and infrastructure to hit hospitals, government, or manufacturing. DAYS later, we get this exact canned reply. No shit it's gone. It was live when we reported it 2 FUCKING DAYS AGO Glad the threat actors could finish their work before you started yours

DarkFibre @Darkfibr3

2 days ago

@uwu_underground CF is a peace of shit. I found implants and C2's targeting Crit. fuel infra and its fucking hit or miss. half the time they say its "the content appears to be no longer active or available." Like brah can you look again.. I do this shit everyday. I have better luck with feds

1 0 52 11K 6

Well, this is awkward. Back in March, I questioned the grand idea that AI agents could replace entire engineering teams. Now Meta is reportedly rebuilding management layers because humans are spending too much time cleaning up after the machines. Turns out firing the adults and leaving the interns in charge wasn’t much of a strategy…. even when the interns are artificial.

keyboard_arrow_left Previous keyboard_arrow_right Next

Amanda Goodall @Amanda_Goodall

7 months ago

The Oracle layoffs being discussed (20–30k range) are real. But the viral story about AI agents replacing DBA teams doesn’t match how enterprise infrastructure actually works and it doesn’t match any of the workforce data either. Database automation tools have existed for

63 124 1K 319K 205