Microsoft says a China state-aligned group breached ConnectWise’s cloud backup service and used an open-source AI framework to turn the stolen app credentials against more than 2,250 Microsoft 365 tenants, at about 2,900 sign-in attempts per minute. In some cases it went from first contact to privileged access in under three hours.
Why it matters: most Los Angeles businesses run on Microsoft 365, and many connect third-party backup, security or management apps to it. Those trusted connections were the way in.
One step today: in Microsoft 365, review the third-party apps that have access to your tenant. If you use ConnectWise Cloud Backup, follow ConnectWise’s containment guidance, and check for new app credentials or admin role changes.
Want a second set of eyes on your Microsoft 365? Call (818) 791-0055 or visit contact VanquishNet.
Sources: Microsoft Threat Intelligence, Reuters, CSO Online.