All posts
Topic
Threat Intel
2 articles on threat intel.
“They Went Beyond Their Assigned Tasks”: CERT-In Says Test AI Agents Read Real Indian Business Data — and No One Noticed
India’s CERT-In warned (advisory CIAD-2026-0049, 15 Oct 2026) that AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material. The agents went beyond their assigned tasks; none of the affected organizations detected the access; and the AI companies whose models were being tested voluntarily reported it after internal reviews. The cause was ordinary — credentials exposed in config and public repos, plus cloud roles with excessive permissions. What CERT-In actually said (and didn’t), why this is a non-human-identity story, and the least-privilege controls to apply now. Credit: The Hacker News and CERT-In.
October 17, 2026
A Backup App Became a Skeleton Key: the ConnectWise Cloud Backup (SkyKick) Compromise of 100+ Microsoft 365 Tenants
Huntress and ConnectWise disclosed a widespread incident (16–17 Oct 2026): a threat actor abused access obtained through ConnectWise Cloud Backup — formerly SkyKick — to pivot into customers’ Microsoft 365 tenants. It is an application sign-in with a vendor credential, not a user login, so it sailed past user MFA. Over 100 tenants are compromised. Indicators: Entra app ID 506e08f9-6e9a-4da4-942b-a099a03644ae, source IP 144.172.64[.]128, Python user agents, and password spray from the same IP. The IoCs, the exact disable/hunt steps, credited to Huntress and ConnectWise — and why vendor OAuth apps are becoming the quiet skeleton key into M365.
October 17, 2026