Security researchers are tracking an active intrusion in which attackers leveraged one stolen Microsoft 365 login tied to ConnectWise Cloud Backup (the service formerly known as SkyKick) to break into 173 different customer tenants. Because that platform handles cloud backups for managed service providers, a single leaked credential there gave the attackers a foothold across many unrelated organizations simultaneously. The campaign remains ongoing, illustrating how one compromised third-party account can cascade into dozens of separate victim environments.
// source: thehackernews.com ↗