Cyber Threat Brief — October 17 2026
⚠️ This report is AI-generated. Always validate findings.
1. ConnectWise Cloud Backup (SkyKick) — stolen Microsoft 365 app credential used across customer tenants
TL;DR: Someone holding the credential for the ConnectWise Cloud Backup multi-tenant app (formerly SkyKick Backup) used it on Oct 15 to request Microsoft Graph tokens in customer tenants, and in one tenant a ConnectWise Cloud Management app made itself Global Administrator and added secrets to other privileged apps. Disable the ConnectWise app IDs below in Entra today (disable, do not delete), then review service principal sign-ins and app credential changes back to Oct 13.
What’s New:
- ConnectWise found the unauthorized access on Oct 14, revoked the app’s certificates, and suspended Cloud Backup for all partners on Oct 17. It says the encrypted backup archives show no sign of access, but it cannot see into customer tenants.
- Huntress has confirmed unauthorized sign-ins in 162 tenants as of Oct 16, 19:00 UTC. Todyl independently saw the same app, IP, and User-Agent in tenants it monitors. How the credential was stolen is not public.
- The app holds tenant-wide read/write access to mail and attachments, OneDrive, SharePoint, and Teams chats. Huntress saw no mail or file access in the audit logs it reviewed, but Graph directory reads leave no audit trail.
- On Oct 17 Huntress said it has high confidence the actor also abused three ConnectWise Cloud Management apps (Exchange Online, MS Teams, SharePoint Online), which ConnectWise had not disabled. Those apps gave themselves directory roles, mostly Exchange Administrator, in about 50 tenants from 01:58 UTC on Oct 15. Huntress’s earliest victims skew toward tenant names starting with “A”.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Enterprise app ConnectWise Cloud Backup / SkyKick Backup, AppId 506e08f9-6e9a-4da4-942b-a099a03644ae (owner tenant 3f9cd7a0-127a-4ed4-bf06-2f830d5616b7) | Compromised third-party app | T1199 | Entra Enterprise applications inventory | Disable AppId 506e08f9-6e9a-4da4-942b-a099a03644ae in Enterprise applications; do not delete it. Do not re-enable it until ConnectWise confirms the credential has been rotated. |
Enterprise app ConnectWise Cloud Management - MS Teams, AppId 24205314-2b89-4e07-a2a4-579e898a5640 | Abused third-party app | T1199 | Entra Enterprise applications inventory | Disable AppId 24205314-2b89-4e07-a2a4-579e898a5640. This is the app that made itself Global Administrator and added secrets to other apps. |
Enterprise app ConnectWise Cloud Management - Exchange Online, AppId b78f6a77-d4e5-46fb-87e5-d1648bd02519 | Abused third-party app | T1199 | Entra Enterprise applications inventory | Disable AppId b78f6a77-d4e5-46fb-87e5-d1648bd02519 and remove any Exchange Administrator role it holds that you did not grant. |
Enterprise app ConnectWise Cloud Management - SharePoint Online, AppId b2b55f5b-7758-4719-8d8f-88ae172e6bdb | Abused third-party app | T1199 | Entra Enterprise applications inventory | Disable AppId b2b55f5b-7758-4719-8d8f-88ae172e6bdb and review the directory roles assigned to it since Oct 13. |
Service principal sign-in with AppId 506e08f9-6e9a-4da4-942b-a099a03644ae from an IP outside Azure | Stolen app credential use | T1078.004 | Entra AADServicePrincipalSignInLogs (Service principal sign-ins tab) | Filter service principal sign-ins on AppId 506e08f9-6e9a-4da4-942b-a099a03644ae from Oct 13 onward and flag any IPAddress that is not Azure; the app normally signs in from Azure private IPv6. Any hit means a Graph token was issued to the attacker in your tenant. |
Source IP 144.172.64[.]128 (AS14956, RouterHosting) | IOC | T1078.004 | Entra user and service principal sign-in logs / firewall | Block 144.172.64.128 and search both user and service principal sign-ins for it since Oct 13. Todyl saw its app sign-ins on Oct 15 between 07:11 and 08:47 UTC; Huntress saw 06:13 to 08:34 UTC. |
Service principal sign-in SessionId starting with 009ae85a- | Attacker session marker | T1078.004 | Entra AADServicePrincipalSignInLogs | Search for SessionId values beginning 009ae85a-. Todyl saw every attacker session start with this prefix, with clientAssertion credentials and Conditional Access notApplied. |
User-Agent Python-urllib/3.12 on sign-ins or audit events from a ConnectWise app | Scripted app abuse | T1078.004 | Entra sign-in logs / Entra audit logs | Alert when any ConnectWise AppId signs in or changes the directory with Python-urllib/3.12. ConnectWise’s own apps use kiota-dotnet; ConnectWise also lists python-requests/2.31 as attacker traffic. |
Audit Add member to role where the target is a ConnectWise service principal and the role is Global Administrator | Role self-assignment | T1098.003 | Entra audit logs (RoleManagement) | Search for Add member to role targeting ConnectWise service principals since Oct 13. Remove Global Administrator from AppId 24205314-2b89-4e07-a2a4-579e898a5640 wherever it appears and treat that tenant as compromised. |
Audit Update application – Certificates and secrets management initiated by a ConnectWise service principal | New app secret (persistence) | T1098.001 | Entra audit logs | List every secret or certificate added to any app registration since Oct 13 and remove ones you did not create. In the confirmed tenant the new secrets were set to expire in 2028 and landed on an MSP management app and a security vendor’s app. |
Audit Add service principal credentials initiated by a ConnectWise service principal | New service principal secret (persistence) | T1098.001 | Entra audit logs | Search Add service principal credentials since Oct 13 and revoke any credential that a ConnectWise app added. Check Conditional Access for exclusions that cover these apps. |
User-Agent curl/7.88.1 OAuth token requests from 144.172.64[.]128 with ResultType 50053 (account locked) | Password spray | T1110.003 | Entra user sign-in logs | Search user sign-ins for curl/7.88.1 from 144.172.64.128 on Oct 13–14. Huntress saw this spray hit four law-firm tenants and trip smart lockout on two accounts; reset any account that later signed in successfully. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Azure AD Privileged Role Assigned to Service Principal | Catches the Global Administrator and Exchange Administrator self-assignments; nothing flags the app’s own Graph sign-ins from a new IP. |
| Elastic | Partial — Entra ID Service Principal with Unusual Source ASN | First-seen service principal plus non-Microsoft ASN would fire on the AS14956 sign-ins; it needs the Entra sign-in integration and 10 days of history. |
| Sigma | Partial — App Assigned To Azure RBAC/Microsoft Entra Role | Covers the role self-assignment only; no rule covers service principal sign-ins from new infrastructure. |
Detection index: ESCU d6afc62 (2026-10-16) · elastic detection-rules a61fa31 (2026-10-16) · SigmaHQ 864c5a3 (2026-10-17).
Hunt hint: Start in Entra, not the mail logs, because Graph directory reads are not audited. Pull service principal sign-ins for AppId 506e08f9-6e9a-4da4-942b-a099a03644ae and every other ConnectWise AppId since Oct 13, and flag anything that is not Azure IPv6, is Python-urllib or python-requests, or starts with session 009ae85a-. Then pull the audit log for Add member to role, Add service principal credentials, and Update application – Certificates and secrets management where a ConnectWise service principal is the initiator. MSPs should check management and security-tool apps first, because a new secret there gives the actor delegated reach into downstream tenants.
Sources: ConnectWise Trust Center advisory · Huntress: vendor credential enables unauthorized access · Todyl investigation · The Hacker News
2. AOMEI Backupper and AnyViewer — UNC7017 update-file tampering delivers CROSSROAD and SHINYROAD
TL;DR: GTIG and Mandiant say UNC7017 edited two unsigned update files on AOMEI’s servers for five to ten minutes at a time between May and July, so installed copies of AOMEI Backupper and AnyViewer fetched the CROSSROAD downloader, which planted the SHINYROAD backdoor through a signed Radmin binary. AOMEI fixed its servers on July 29, but infected endpoints stay infected. Hunt every host that runs AOMEI software for the scheduled task and files below.
What’s New:
- The client trusts
down_html.iniandNotifycfg.iniwithout a signature, and the MD5 check sits inside the same file the attacker edited. Confirmed windows were May 28 (05:40–05:50 UTC), July 16 (08:33–08:39 UTC), and July 20 (10:35–10:40 UTC). - ManageEngine’s lab caught the chain in its own EDR telemetry on May 28 and July 16 and published process trees and two Sigma rules. Victims span at least 11 countries in IT services, telecom, and higher education.
- The July 20 change also pushed a one-pixel pop-up pointing at a WebDAV share, which leaks NetNTLMv2 hashes with no code execution. On some hosts the actor followed up with an Adaptix C2 agent disguised as Nitro PDF.
- CROSSROAD restores the clean
down_html.iniafter it runs, and on some code paths it skips its payload on hosts that geolocate to China. Live checks of AOMEI’s servers or the local file will therefore look clean.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
ABNotify.exe spawning upgrade-now.exe from C:\Program Files (x86)\AOMEI\<product>\html\ | Malicious update execution | T1195.002 | Sysmon 1 / EDR process events | Search process starts where ParentImage ends with \ABNotify.exe and Image is upgrade-now.exe under an AOMEI html\ folder since May 2026. A child rsetup64.exe /intsetup (Radmin installer) confirms CROSSROAD. |
Scheduled task \RadminComponentRuntime running %LOCALAPPDATA%\Radmin\FamItrfc.exe --runtimechk | Persistence | T1053.005 | Security 4698 / TaskScheduler Operational 106 / Sysmon 1 | Alert on task name RadminComponentRuntime or any process with command line --runtimechk. The task fires every three hours, so a live host will show it repeatedly. |
Unsigned BlkScrDl.dll loaded by signed FamItrfc.exe from %LOCALAPPDATA%\Radmin\ | DLL search-order hijack | T1574.001 | Sysmon 7 (image load) / EDR | Search image loads where Image ends with \Radmin\FamItrfc.exe or \Radmin\FamItrf2.exe under a user profile and ImageLoaded is BlkScrDl.dll, RuntimeComponent.dll, or WNTestDll.dll. Real Radmin installs live in Program Files, not %LOCALAPPDATA%. |
SHA-256 5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e | File hash (BlkScrDl.dll, SHINYROAD loader) | T1574.001 | EDR file inventory / threat-intel blocklist | Add the hash to blocklists and sweep EDR file inventory for it. Both GTIG and ManageEngine published this hash. |
SHA-256 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 | File hash (upgrade-now.exe, CROSSROAD, July 16) | T1195.002 | EDR file inventory / threat-intel blocklist | Add the hash to blocklists. GTIG also lists b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 (July 20) and 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad (May) for the same file name. |
Domain storage-data[.]com (including promotion. and aomei. subdomains) | IOC | T1105 | DNS / web proxy logs | Block storage-data.com and its subdomains and search DNS and proxy logs back to April 2026. Any resolution from a host running AOMEI software marks it for triage. |
URL prefix storage.googleapis.com/aomeiupdate/ | IOC (payload staging) | T1105 | Web proxy logs | Search proxy logs for requests to storage.googleapis.com/aomeiupdate/. The actor moved staging here on July 20 to avoid newly-registered-domain filters, so domain blocks alone miss it. |
IP 8.218.65[.]184 on TCP 443 or 41397 | IOC (SHINYROAD C2) | T1571 | Firewall / NetFlow / EDR network events | Block 8.218.65.184 and search for outbound sessions to it. SHINYROAD has a single hard-coded C2 with no fallback, so one hit is enough to confirm the implant. |
IP 8.210.84[.]56 on TCP 6800 | IOC (Adaptix C2) | T1071.001 | Firewall / NetFlow | Block 8.210.84.56 and search for outbound TCP 6800, which the Adaptix agent beacons on every two minutes. |
UNC path \\8.210.84.56\DavWWWRoot\campaign\24hour-flash-sale.html | NTLM hash coercion | T1187 | Sysmon 1 (rundll32.exe running davclnt.dll,DavSetCookie) / perimeter SMB and WebDAV logs | Search for DavSetCookie command lines naming 8.210.84.56, and block outbound SMB (445) and WebDAV to the internet. Reset passwords for users on any host that reached this share on or after July 20. |
User-Agent Anyviewer-loader/1.0 | Malware HTTP client | T1071.001 | Web proxy logs | Alert on Anyviewer-loader/1.0 and Anyviewer-ipcheck/1.0. Genuine AOMEI clients do not use these strings. |
Scheduled task \NitroRuntime launching %TEMP%\NitroPromotion.exe with -WindowStyle Hidden | Persistence (Adaptix loader) | T1053.005 | Security 4698 / Sysmon 1 | Alert on task name NitroRuntime and on NitroPromotion.exe loading Eztwain4.dll from %LOCALAPPDATA%\Nitro Pro\. Treat any hit as hands-on-keyboard follow-up. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows Unsigned DLL Side-Loading In Same Process Path | Fires on the unsigned BlkScrDl.dll load next to FamItrfc.exe; nothing keys on AOMEI updater children or the RadminComponentRuntime task. |
| Elastic | Partial — First Time Seen Remote Monitoring and Management Tool | The Famatech Corp. signer match fires the first time FamItrfc.exe runs on a host; it says nothing about the AOMEI parent. |
| Sigma | Partial — Suspicious WebDav Client Execution Via Rundll32.EXE | Covers only the July 20 WebDAV hash leak to an external IP. ManageEngine’s two AOMEI rules are not in SigmaHQ. |
Detection index: ESCU d6afc62 (2026-10-16) · elastic detection-rules a61fa31 (2026-10-16) · SigmaHQ 864c5a3 (2026-10-17).
Hunt hint: Build the host list first: every endpoint with AOMEI Backupper or AnyViewer installed, from software inventory. On those hosts, look for a %LOCALAPPDATA%\Radmin\ folder, the RadminComponentRuntime or NitroRuntime tasks, and ABNotify.exe launching anything from the html\ folder. Then compare each cached down_html.ini in the AOMEI Tmphtml\ folder against a clean copy, and check proxy logs for storage-data.com or storage.googleapis.com/aomeiupdate/ around the three tampering windows. Do not clear a host because AOMEI’s live update URL looks clean today; the tampering lasted minutes. GTIG published YARA rules G_APT_Downloader_CROSSROAD_1 and G_APT_Backdoor_SHINYROAD_1 for file sweeps.
Sources: GTIG / Mandiant: Investigating Ephemeral Supply Chain Tampering · ManageEngine Threat Analysis Lab · The Hacker News
Status Updates
- CVE-2026-102764 (BeyondTrust Remote Support): CISA added it to KEV on Oct 16 (due Oct 19, forensic triage required) and says attackers are using it to persist, escalate, and move laterally. Still no public PoC. Original brief.
- CVE-2025-61624 (FortiOS auto-script path traversal / PEERSTITCH): CISA added it to KEV on Oct 16 (due Oct 19, forensic triage required). Original brief.
- CVE-2026-0322 (PAN-OS management interface): KEV due today, Oct 17. No advisory change since 11.2.16 shipped on Oct 15. Original brief.
- CVE-2026-76519 (Cisco Secure Email Gateway): KEV due today, Oct 17. The advisory is still version 1.0; its only built-in check is
grep "System Security" system_logs. Original brief. - CVE-2026-105133 / CVE-2026-105134 (AhsayCBS): KEV due today, Oct 17. Fixed by hotfix 10.3.4.45 (v10) or 9.15.2.70 (v9), followed by a reboot. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): KEV due tomorrow, Oct 18, forensic triage required. Original brief.
- KEV deadlines passed: CVE-2026-104935 (Ivanti Connect Secure, due Oct 16; the privilege-escalation fix still has not shipped) and CVE-2026-96951 (Windows Shell, due Oct 16) (brief); CVE-2026-86950 (Apple CoreGraphics, due Oct 13) (brief); the Flax Typhoon set CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, and CVE-2023-22894 (due Oct 11) (brief); CVE-2026-0257 (GlobalProtect) (brief).
- Deferred, not yet briefed: Langflow CVE-2026-105740 is still single-origin (Previdian: 2,095 attempts from 28 IPs through Oct 17); recheck Oct 20. New: Adobe Commerce and Magento “BlockStrap” CVE-2026-103849 (APSB26-153, template-directive injection to RCE, no exploitation yet; Sansec expects working exploits soon). Apply the 2026-oct release now; recheck Oct 19. PwnEscape CVE-2026-99999 recheck Oct 19. Dropped with no attacks reported: SAP Cloud SDK CVE-2026-89111 (fixed in 0.45.2) and Ghostscript CVE-2026-39919 (fixed in 10.08.0). Also dropped: SiteGuard CVE-2026-106931 (exploited, but local-only; fixed in Ver8.00 Update5).
- Watching (no change): CVE-2026-110447 Collabora CODE (10-15); CVE-2026-102255 SonicWall SMA1000 SSRF, still not in KEV (10-10); FROMAGEGATE (10-13); GhostAction (10-10); CVE-2026-97229 GitLab, still no confirmed exploitation (10-13); CVE-2026-85097 and CVE-2026-107406 (10-09); CVE-2026-82077 (10-11); CVE-2026-61500 and CVE-2026-88062 (10-04).