Daily Brief
ConnectWise tenant compromise and SiteGuard WAF flaw
Hackers exploit SiteGuard WAF flaw to run commands as admins
Attackers are exploiting an OS command injection flaw in SiteGuard Server Edition. The issue can let them run commands as root or SYSTEM on affected servers, which makes exposed installations a high-risk target.
Review whether SiteGuard Server Edition is exposed in your environment and prioritise patching or compensating controls for any affected servers.
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Researchers say an active campaign is abusing a compromised ConnectWise Cloud Backup Microsoft 365 credential to access customer M365 environments. The activity affects 173 Microsoft 365 tenants and shows how a single service identity can become a route into multiple customers.
Audit Microsoft 365 sign-ins tied to ConnectWise Cloud Backup identities and look for unusual access across tenant administration and mailbox activity.