In partnership with
| ~7 MIN READ |
|
This edition is about the things you invited in: apps with tenant-wide keys, auto-updaters, ad networks, and AI agents that do exactly what they're asked, a little too well. PS: Was this forwarded to you? Subscribe free at exzeccyber.com/subscribe → |
In this edition
|
Supply Chain / M365 173 Microsoft 365 Tenants Let an Attacker Walk In Through Their Backup App Intro MFA protects your users. It does nothing for the backup app you handed the keys to every mailbox. What Happened Attackers abused a compromised credential for ConnectWise Cloud Backup (formerly SkyKick), an app with broad access to mailboxes, OneDrive, SharePoint, Teams and directory data, to pull Microsoft Graph tokens from customer tenants on October 15. Huntress confirmed unauthorized sign-ins in 173 partner and customer tenants, and Microsoft is tracking it as an active supply chain attack. In at least one tenant, a related ConnectWise Teams app added itself to Global Administrator and planted new secrets in an MSP management app and in Huntress's own app. Why It's Important The attacker signed in as the app, so no user ever logged in and revoking user sessions changes nothing. Huntress later counted almost 1,000 Entra tenants with sign-in activity from the attacker's IP, plus a failed second wave at 16 policy, national security, trade and critical mineral organizations. The Other Side ConnectWise says it has no evidence backup archives were accessed, and it disabled seven app identities on October 17. It still doesn't know how the credential was exposed.
TL;DR: A compromised backup-app credential gave attackers mailbox-level access to 173 Microsoft 365 tenants. Further reading: The Hacker News |
|
You built the audience. Can you reach them?
You can have thousands of people following your work and still need an algorithm’s permission to reach them. Creators know the drill: you post, you pray, you check the numbers, you try again tomorrow.
A newsletter changes that relationship. On beehiiv, you can build a subscriber list you own, reach readers directly, and turn their attention into a sustainable business with subscriptions, sponsors, a global ad network, and more.
|
|
|
Leave Granola and get up to 12 months free of Wispr Flow Notetaker + Dictation
If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.
 Strange but real An Alleged Pizza-Data Thief Got Caught Browsing the Loot From His Own IP Address Intro Stealing hundreds of millions of pizza orders is one thing. Browsing them from home is another. What Happened Russian police detained three suspected members of the DataSuckers group, and a Moscow court put 19-year-old Denis Fridman under house arrest until December 8 over the Dodo Pizza breach. The records reportedly cover hundreds of millions of orders over 15 years. Russian outlet Baza reports Fridman exposed his own IP address while accessing the stolen data, which led police to his home in Barnaul. Why It's Important The breach allegedly started with Dodo corporate credentials exposed on GitHub, which opened cloud storage, databases and stored passwords. Kommersant reports the database was offered for $100,000, paid into a shared crypto wallet whose password changed after his arrest. The Other Side The Record couldn't verify how police found him, and the group's bigger claims, like data on 7.9 million customers at Ukraine's ATB grocery chain, are unverified and denied. A fourth alleged member is still at large.
TL;DR: An alleged pizza-data hacker reportedly got caught browsing the stolen data from his own IP. Further reading: The Record |
A deal has two sides. Your stack only sees one.
Aligned shows you the other half. See what buyers actually do between meeting. See what they open, revisit, and share; so you know the exact next step to move things forward. And your champion gets everything they need to win internally when you're not in the room.