Section
Research
Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.
6 matching records, 1 with confirmed exploitation.
-
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX…
-
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
A recent phishing campaign abused Microsoft Power BI links to deliver multiple rogue ScreenConnect clients.
-
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
-
ConnectWise Cloud Backup application abused in cross-tenant token sweep
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants Categories: Threat Research Tags: connectwise
-
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started⦠I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[ 1 ] about ScreenConnect used in the wild. Today, I…
Reuse this view
Same filters as JSON: /api/items?category=research&window=30d&vendor=ConnectWise&limit=100. RSS for this section: feed.xml.