ConnectWise disables seven of its own app identities after attackers use them to break into Microsoft 365 tenants

The Hacker News reported that ConnectWise said on Saturday it has disabled seven ConnectWise application identities while it investigates an incident in which unknown threat actors obtained unauthorized access to those application identities and compromised Microsoft 365 tenants. The Hacker News's headline states ConnectWise has suspended cloud backup. This is a live, ongoing compromise that reaches into customer Microsoft 365 environments through a trusted vendor's identities, which is why it leads today.

What to do: if you run ConnectWise products tied to Microsoft 365, treat the disabled application identities as the signal they are. Review your tenant's enterprise applications and service principals for ConnectWise identities, and pull Entra ID sign-in and audit logs for activity by those identities. The Hacker News reported ConnectWise listed the disabled identities; match that list against your own tenant and follow ConnectWise's investigation updates.

Separately, BleepingComputer reported that attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. BleepingComputer describes this as being exploited now, not theoretical. If you run SiteGuard Server Edition, check the vendor for a fix and review affected hosts for signs of command execution — new processes, unexpected outbound connections, and changes made under the root or SYSTEM account.

Two further items ran in Help Net Security's week in review, published Sunday. Help Net Security reported a hidden implant in Ledger wallets linked to a $93 million theft, and that more than 1,500 npm packages were exposed. If you hold assets on Ledger hardware wallets, or if your build pipeline pulls from npm, these are worth tracking as Help Net Security publishes detail.

For context on the market, SecurityWeek reported that US cybersecurity job postings fell 26% while demand for AI security engineers rose, citing CyberSN's Cybersecurity Jobs Report. That is a hiring signal, not a security action, and is grouped here as background.