All posts
Topic
Microsoft 365
2 articles on microsoft 365.
A Backup App Became a Skeleton Key: the ConnectWise Cloud Backup (SkyKick) Compromise of 100+ Microsoft 365 Tenants
Huntress and ConnectWise disclosed a widespread incident (16–17 Oct 2026): a threat actor abused access obtained through ConnectWise Cloud Backup — formerly SkyKick — to pivot into customers’ Microsoft 365 tenants. It is an application sign-in with a vendor credential, not a user login, so it sailed past user MFA. Over 100 tenants are compromised. Indicators: Entra app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, source IP 144.172.64[.]128, Python user agents, and password spray from the same IP. The IoCs, the exact disable/hunt steps, credited to Huntress and ConnectWise — and why vendor OAuth apps are becoming the quiet skeleton key into M365.
October 17, 2026
Microsoft Teams Security Best Practices: A CISO's Hardening Guide
A concrete, admin-ready guide to hardening Microsoft Teams: external access and federation controls, guest and app governance, meeting policies, phishing defense, token-theft and Conditional Access, DLP, and Purview monitoring.
September 10, 2026