Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
ConnectWise Cloud Backup Breach: What We Know
Excerpt
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick , after researchers detected the applications authenticating into customer Microsoft 365 environments. A vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS Security, and…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 144.172.64.99 | Medium | Score 58/100 | First seen |
| IP | 144.172.64.60 | High | Score 63/100 | First seen |
| IP | 144.172.64.128 | High | Score 87/100 | First seen |
IOC Relationship Graph
Building graph…