ConnectWise Cloud Backup application abused in cross-tenant token sweep
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants Categories: Threat Research Tags: connectwise
Read at Sophos X-Ops threat research
- Vendor
- Microsoft, ConnectWise
- Product
- ScreenConnect / Automate
- Exposure class
- Remote access
Why it ranks 16 (Routine)
- Exposed product class: remote access
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Sophos X-Ops threat research (sophos.com)