Daily Brief
Supply chain attacks and active exploitation
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise disabled seven application identities and suspended Cloud Backup after attackers obtained unauthorised access to application identities and compromised Microsoft 365 tenants. This matters because a service provider incident can affect downstream customers and cloud access at scale.
Review your Microsoft 365 app identities and delegated access, and check whether any ConnectWise-connected services need containment or rotation this week.
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Attackers began exploiting a chain of Plex Media Server vulnerabilities a day after a proof of concept was published, using it to install cryptocurrency miners and Linux proxy backdoors. This shows how quickly public exploit code can turn a vulnerability chain into real intrusions.
Identify Plex Media Server instances, confirm patch status, and hunt for miner activity or proxy backdoors on exposed systems.