Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
9 / 23 results
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
criticalbug_reportVulnerabilityConnectWise ScreenConnect CVE-2026-84869 actively exploited in wild
ConnectWise ScreenConnect versions prior to 26.6.5. Affects ScreenConnect clients used by MSPs and IT teams for remote access and system management. Over 1,000 unpatched instances exposed online, primarily in North America (758) and Europe (180).
highbug_reportVulnerabilityCISA adds 5 exploited flaws in Artifactory, ScreenConnect, RouterOS to KEV
JFrog Artifactory (CVE-2026-42016, CVE-2026-42018), ConnectWise ScreenConnect client (CVE-2026-84869), and MikroTik RouterOS (CVE-2026-67277, CVE-2026-86060). All vulnerabilities are actively exploited in the wild.
highbug_reportVulnerabilityWorm-like malware abuses ConnectWise ScreenConnect for lateral spread
ConnectWise ScreenConnect clients (all versions). Attackers deploy rogue ScreenConnect instances via phishing, tech support scams, and fake refund forms.
highbug_reportVulnerabilityConnectWise ScreenConnect file transfer flaw lacks patch, mitigation only
ConnectWise ScreenConnect Remote Access (all versions, both cloud and on-premises deployments). Approximately 6,000 instances exposed online. No CVE ID assigned yet. Affects file transfer behavior in Support and Access sessions.
highperson_alertThreat ActorSMOKE#SCREEN Campaign Deploys ScreenConnect via Fake Software Updates
SMOKE#SCREEN is an unattributed multi-wave campaign active as of August 2026 that leverages social engineering to deploy ConnectWise ScreenConnect RMM software for persistent remote access.