Viktor Hedberg 🛡💻

I do security stuff @Truesec • MVP • Father • My tweets are my own • He/him

[Viktor Hedberg 🛡💻 @headburgh]

219 domain admins.

[Kayla Cinnamon ☕️ @cinnamon_msft]

Write a scary story in 6 words or less.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants.

ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All.

On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor.

Microsoft Defender detects post-exploitation activity with the following alerts:
- Any alert related to "Suspicious sign-in"
- Graph API activity from a Microsoft threat intelligence IP address
- Verified Threat Actor IP

Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities.

We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: https://t.co/zwFyMAzaEV.

Indicators of compromise (IOCs):
- App name: ConnectWise Cloud Backup
- AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae
- Publisher name: SkyKick
- Source IP: 144.172.64[.]128
- User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

[Huntress @HuntressLabs]

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).

We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

[Viktor Hedberg 🛡💻 @headburgh]

@NathanMcNulty

[Viktor Hedberg 🛡💻 @headburgh]

@UK_Daniel_Card Had it for dinner yesterday, accurate depiction of what transpired.

[Viktor Hedberg 🛡💻 @headburgh]

@UK_Daniel_Card What? But what about all the "AuToNoMoUs" attacks we've been told should've, would've happened by now? 😅

[Viktor Hedberg 🛡💻 @headburgh]

@NathanMcNulty Yes, but perhaps some devices should not be Entra joined.. Like your PAW for on-prem AD #KeepingStuffOldSchool ;D

[Viktor Hedberg 🛡💻 @headburgh]

@techspence This made me cackle. Hard!

[Viktor Hedberg 🛡💻 @headburgh]

@merill My statement doesn´t change.

[Viktor Hedberg 🛡💻 @headburgh]

@techspence 🙋

[Viktor Hedberg 🛡💻 @headburgh]

@techspence But, everything just "works" then..?

[ExpertsLiveSE @ExpertsLiveSE]

🔧 Jobbar du med Microsoft‑teknik?
Då är Experts Live Sweden 2026 konferensen du inte vill missa.

Registrera dig: https://t.co/wdu3NGlgRk
Communitydrivet. Ideellt. Fullt fokus på Microsoft‑stacken.

#Microsoft #ELSE26 #ExpertsLive

[Viktor Hedberg 🛡💻 @headburgh]

@NITESHRAJPOOT @PyroTek3 MS Creates a baseline policy if you have P1 licenses on a tenant level. But in short, any user that can "benefit" from the feature needs to have a license assigned.

[Viktor Hedberg 🛡💻 @headburgh]

@AdamTheRock1 @horizon_secured Beg to differ, don't try to do it all at once. Get the structure in place in parallell to the existing env, and migrate into the tiering structure. Done it that way for 50+ companies worldwide the last couple of years.

[Steven Lim @0x534c]

Azure Bastion CVE-2025-49752 👀

CVSS Score: 10/10
Affected: All Azure Bastion deployments prior to the security update released on November 20, 2025

https://t.co/MTpd2zaxeL

[Viktor Hedberg 🛡💻 @headburgh]

@UK_Daniel_Card Why bother hacking stuff and spending $ on some 0-day or whatever, when admin/admin, cisco/cisco or whatever gives you what you need? 😅

[mRr3b00t @UK_Daniel_Card]

Key things seen in ransomware incidents:

1) VPN does not require MFA
2) Standard User VPN access gives access to management interfaces
3) LDAP access leads to domain admin via: Passwords in description fields, kerberoasting and other common escalation points (but seriously the above is major)
4) the backup servers are primary corp domain joined
5) the vcenter servers are primary corp domain joined

this gives the threat actor the ability to:
> destroy your backups
> destroy your virtual infrastructure
> delete/encrypt your data
> exfiltrate the data

[Viktor Hedberg 🛡💻 @headburgh]

@NathanMcNulty I only use PIN inside Windows Hello for Business 😁

[Viktor Hedberg 🛡💻 @headburgh]

@NathanMcNulty 😅😅