🤦 They Passed MFA. So Did the Attacker.

Huntress tracked a 10-week Microsoft 365 campaign where attackers replayed sign-in tokens stolen after MFA, then planted rogue devices, MFA methods, and hidden inbox rules. Here is how MSPs close the gaps with Conditional Access and finish the cleanup…

⚠️ Threat Updates

🔴 ConnectWise Cloud Backup (SkyKick) Credential Abuse: Disabling the App Isn't the Whole Fix (10/28/26)

On Oct. 15, an attacker used a stolen credential for ConnectWise Cloud Backup, formerly SkyKick, to sign in to Microsoft 365 tenants as the backup app itself, inheriting its broad access to mail, files, Teams and directory data. Huntress saw sign-in activity from 144.172.64[.]128 in almost 1,000 Entra tenants, more than 300 of them successful. In two tenants it examined closely, a related ConnectWise Cloud Management app granted itself Global Administrator and planted new secrets on other apps, in one case including an MSP management tool. Microsoft has attributed the activity to a China state-aligned group it tracks as Storm-0940. ConnectWise disabled the affected apps Oct. 17, reset credentials in the affected environment, and on Oct. 28 began restoring backups through a new app, "ConnectWise Cloud Backup for M365." This is a risk every MSP shares: any backup, RMM or security app consented across client tenants is only as safe as the keys behind it, and app-only sign-ins never trigger an MFA prompt. Keep the old apps disabled, not deleted, reset your Cloud Services portal password, re-authorize each tenant with the new app, and confirm new snapshots complete. Re-authorizing doesn't clean a tenant. In your own and every client tenant, preserve logs first, then review all enterprise apps and app registrations for secrets or certificates added since Oct. 13, remove privileged roles you didn't grant to service principals, and search service principal sign-ins for the attacker IP. Document what you can't see, since Microsoft Graph directory reads leave no audit record. » More Info

🔴 FortiGate and Palo Alto Firewalls Under Active Attack: FortiBleed and k0t Campaigns Feed Ransomware Gangs (10/28/26)

Two overlapping campaigns are breaking into internet-facing Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and passing the access to ransomware crews. FortiBleed uses no software flaw: attackers rely on leaked credentials, infostealer logs, password spraying and offline cracking of legacy SHA-256 password hashes, and SOCRadar has verified compromised credentials for more than 86,644 devices in 194 countries. An Oct. 6 FBI and Secret Service advisory says the attackers create new admin accounts, sometimes delete or change the originals to lock owners out, and sell access to INC/Lynx and Payload ransomware affiliates. A separate actor, k0t, adds brute force and exploits for CVE-2025-64446 in FortiWeb and CVE-2026-0257, a GlobalProtect authentication bypass patched in May, and many k0t victims later appeared on Qilin and The Gentlemen leak sites. Unit 42 says Qilin and Inc are exploiting CVE-2026-0257 directly to open VPN sessions that bypass MFA. For MSPs, one reused admin password or exposed management page can put many client networks within reach. Patch every PAN-OS and FortiWeb device now, since MFA won't stop these flaws. Upgrade FortiOS to 7.2.11, 7.4.8, 7.6.1 or later, since older stored passwords only move to stronger PBKDF2 hashing when each admin logs in after the upgrade. Then end all admin and VPN sessions, reset every admin and VPN password, enforce phishing-resistant MFA, and take management interfaces off the internet or restrict them to trusted IPs. Hunt for unknown local admins such as forticloud-sync or fgtsecure, unexpected REST API keys, configuration changes and outbound connections from the firewall itself. » More Info

🗨️ Parting Words

"The most difficult thing is the decision to act, the rest is merely tenacity." – Amelia Earhart

Are you a vCISO or MSP looking to operationalize security programs? Let’s discuss how Blacksmith Infosec proves that compliance is an opportunity, not a struggle that has to be packaged in FUD!