# Threat Intel Brief — October 19, 2026

TL;DR

  • ConnectWise supply-chain breach: Attackers compromised application credentials to access 173 Microsoft 365 tenants, forcing shutdown of Cloud Backup service. MSPs and downstream customers face immediate risk of data exposure and persistent access.
  • SiteGuard WAF exploitation: Active attacks targeting CVE-2026-106931, an OS command injection flaw granting root/SYSTEM privileges on approximately 1.5 million protected websites. Patches available; immediate action required.
  • Drupal critical RCE vulnerabilities: Two unpatched remote code execution flaws affect all supported versions. Vendor warns public exploits may emerge imminently.
  • MALFEX npm campaign: Malicious "imgdecode" package delivers shellcode loader and RAT to Windows developer environments, downloaded 979 times. Actor demonstrates rapid adaptation to npm removals.

Critical Threats

ConnectWise Cloud Backup Supply-Chain Compromise

What happened: Unknown threat actors obtained unauthorized access to ConnectWise application identities and used compromised Microsoft 365 credentials to breach 173 customer tenants between October 13-15, 2026. The attackers authenticated as the legitimate ConnectWise Cloud Backup application (formerly SkyKick), inheriting extensive permissions across mailboxes, SharePoint, OneDrive, Teams, and directory services. In at least one tenant, attackers escalated privileges to Global Administrator and added client secrets to trusted applications for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services on October 17, 2026. A targeted second wave on October 15 focused on 16 tenants in policy, national security, trade, and critical mineral sectors, indicating strategic intelligence collection objectives.

Impact: Organizations using ConnectWise Cloud Backup have lost backup service access and face potential unauthorized access to sensitive Microsoft 365 data. The attack exploits the trust relationship between MSPs and their clients—a single compromised vendor credential provided scalable access across hundreds of downstream organizations. Attackers can read emails, access files, collect Teams messages, and in some cases perform directory operations that leave no audit trail. The privilege escalation to Global Administrator in customer environments enables persistent access, lateral movement, and potential deployment of additional malware. Law firms were specifically targeted with password spraying attempts on October 13-14, suggesting reconnaissance of high-value sectors. The supply-chain nature of this attack means organizations may be compromised without direct targeting, simply through their MSP relationship.

Recommendations: Immediately audit all Microsoft 365 tenants that used ConnectWise Cloud Backup for unauthorized application registrations, new client secrets, and privilege escalations. Disable ConnectWise application IDs (506e08f9-6e9a-4da4-942b-a099a03644ae and 24205314-2b89-4e07-a2a4-579e898a5640) in Entra ID; note that already-issued tokens remain valid for up to 90 minutes. Review Entra ID sign-in logs for authentication from IP address 144.172.64[.]128 or unusual geographic locations between October 13-17, 2026. Hunt for service principals that added themselves to Global Administrator roles or added client secrets to other applications. Rotate all credentials previously granted to ConnectWise services and implement alternative backup solutions. Enable Microsoft 365 unified audit logging and configure alerts for sensitive application permission changes.

SiteGuard Server Edition Command Injection (CVE-2026-106931)

What happened: Attackers are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition's statistics feature, which is enabled by default. The flaw affects versions 2.20 through 8.00 Update 4 for Apache, Nginx, and IIS (excluding FreeBSD), and versions 2.20 through 7.00 Update 5 for FreeBSD editions. IIS editions 3.10 through 4.00 Update 4 are not affected. Both the vendor and JPCERT/CC have confirmed ongoing exploitation in the wild. The vulnerability impacts approximately 1.5 million protected websites globally. The vendor notified direct support customers on September 29, 2026, but attacker identity, victim details, and attack scale remain undisclosed.

Impact: Unauthenticated remote attackers can execute arbitrary operating system commands with root privileges on Linux systems or SYSTEM privileges on Windows servers. The default-enabled statistics feature significantly increases exposure across the install base. Successful exploitation grants complete server compromise, enabling data theft, lateral movement to internal networks, ransomware deployment, or installation of persistent backdoors. Organizations relying on SiteGuard WAF for web application protection face immediate risk of full infrastructure compromise through their security perimeter device.

Recommendations: Immediately identify all SiteGuard Server Edition installations in your environment. Before patching, download diagnostic information from the Web management interface to preserve forensic evidence. Upgrade to version 8.00 Update 5 (or 7.00 Update 6 for FreeBSD) immediately, or apply vendor patches for end-of-life versions from the SiteGuard security bulletin. Conduct forensic analysis on all affected systems for indicators of compromise, focusing on unauthorized command execution, new user accounts, scheduled tasks, and suspicious outbound connections since September 2026. If immediate patching is impossible, disable the statistics function as temporary mitigation. Monitor web server logs for unusual POST requests or command injection patterns in statistics-related endpoints.

Drupal Remote Code Execution Vulnerabilities

What happened: Drupal released patches for two critical remote code execution vulnerabilities affecting all supported versions of the content management system. The vendor has publicly warned that exploits may emerge soon following disclosure. Specific CVE identifiers and version numbers were not provided in available reporting, but the vendor's urgency indicates high exploitability once technical details become public.

Impact: All Drupal installations face critical risk of complete server compromise via remote code execution. The vendor's expectation of imminent exploit development creates a narrow patching window before mass exploitation begins. Public-facing Drupal sites represent high-value targets for automated scanning and exploitation once proof-of-concept code surfaces. Organizations running Drupal in production, staging, or development environments must assume active threat until patching is complete.

Recommendations: Apply Drupal security patches immediately to all instances across production, staging, and development environments. Inventory all Drupal installations and verify patch status within 24 hours. Monitor drupal.org/security for CVE identifiers and specific version guidance. Review web application firewall logs for unusual POST requests, suspicious file upload activity, or abnormal traffic patterns to Drupal endpoints. Implement network segmentation to isolate Drupal servers and restrict outbound connections until patching is complete. Consider temporarily taking non-critical Drupal sites offline if patching cannot be completed within 48 hours.

Threat Actor Activity

MALFEX npm Supply-Chain Campaign

The MALFEX campaign, active since August 2023, continues targeting the Node.js ecosystem with malicious packages designed to compromise Windows developer environments. The latest iteration, "imgdecode," was published September 30, 2026, by user "malfexteste8" and downloaded 979 times before analysis. The package contains a shellcode loader hidden in a Windows native addon (DLL) that decrypts and injects payloads into dllhost.exe, delivering a Go-based downloader, credential stealer (movinlike), and Overlord RAT from infrastructure at 104.234.65[.]75.

The actor demonstrates sophisticated operational security and persistence. When npm removed packages "native-runner" and "img-to-native" on September 28, 2026, the actor published replacements ("imgbundle," "runhelper") within 48 hours. After "runhelper" was unpublished, "imgdecode" appeared six hours later with enhanced capabilities. The malware evolved from requiring multiple dependencies (versions 1.0.0-1.0.2) to standalone operation (version 1.0.3), showing technical adaptation to defensive actions.

The malware employs multiple anti-analysis techniques including VM/sandbox detection and checks for Process Monitor and Wireshark. It uses steganography to embed payloads in image files, Foreign Function Interface modules for shellcode execution, and encrypted blobs retrieved from GitHub repositories (cavecrew/proj). The consistent use of encryption keys containing "malfex" branding and infrastructure reuse across multiple package generations indicates a single persistent actor operating across publisher accounts (malfexkkj, malfex_user, malfexteste2-4, malfexteste8).

Defensive focus: Software development organizations using Node.js on Windows face immediate risk. The campaign specifically targets active development environments rather than production systems, making developer workstations the primary attack surface. Organizations should audit all Node.js projects for dependencies on known MALFEX packages (imgdecode, imgbundle, runhelper, cdn-img-fetch, img-to-native, native-runner), block network connections to 104.234.65[.]75, and implement npm package vetting processes that inspect native addons before installation.

ConnectWise M365 Tenant Intrusions

The unattributed threat actor behind the ConnectWise compromise demonstrated advanced understanding of Microsoft 365 application identity architecture and OAuth token abuse. The adversary conducted systematic enumeration of 173 MSP customer tenants in sorted GUID order within a two-hour window on October 15, 2026, indicating automated exploitation from a pre-compiled target list. Prior password spraying activity against law firm tenants on October 13-14 from the same infrastructure (144.172.64[.]128) suggests reconnaissance preceding the main campaign.

In at least one tenant, the actor escalated privileges by assigning a ConnectWise Cloud Management application to Global Administrator roles and executed Python scripts to add client secrets to other trusted applications, enabling persistence and lateral movement across the MSP's customer base. The attack pattern—broad initial access via trusted application infrastructure followed by targeted operations against policy, national security, trade, and critical mineral sector organizations—indicates strategic intelligence collection objectives rather than opportunistic cybercrime.

Geopolitical Context

The targeted second wave of the ConnectWise compromise focused on 16 organizations in policy, national security, trade, and critical mineral sectors, suggesting state-sponsored or state-aligned threat actor involvement. The strategic selection of these sectors aligns with intelligence collection priorities observed in advanced persistent threat campaigns. The supply-chain approach—compromising a widely-used MSP tool to access high-value downstream targets—mirrors tactics increasingly employed by nation-state actors seeking scalable access to government-adjacent organizations.

The timing of multiple supply-chain attacks this week (ConnectWise, MALFEX npm campaign, and concurrent AOMEI Backupper tampering delivering CROSSROAD/SHINYROAD malware) indicates a broader trend of adversaries targeting backup infrastructure and trusted vendor relationships as force multipliers. Organizations in critical infrastructure, defense industrial base, and government sectors should assume heightened targeting through third-party service providers.

Recommended Actions

Immediate (0-24 hours)

  • ConnectWise customers: Disable ConnectWise application IDs in Entra ID and audit all M365 tenants for unauthorized access between October 13-17, 2026
  • SiteGuard users: Patch CVE-2026-106931 immediately or disable statistics function; conduct forensic analysis for compromise indicators
  • Drupal administrators: Apply critical RCE patches to all instances; isolate unpatchable systems from network
  • Node.js developers: Audit projects for MALFEX packages (imgdecode, imgbundle, runhelper, cdn-img-fetch, img-to-native, native-runner); block 104.234.65[.]75

Short-term (24-72 hours)

  • Review all third-party application permissions in Microsoft 365 tenants; revoke excessive privileges and audit for unauthorized credential additions
  • Implement conditional access policies requiring device compliance for service principal authentication
  • Enable Microsoft 365 unified audit logging and configure alerts for application permission changes, role assignments to service principals, and new application registrations
  • Deploy npm package integrity checks and restrict installation to vetted registries or private mirrors with security scanning
  • Hunt for process injection into dllhost.exe from Node.js processes using EDR telemetry and Sysmon Event ID 8/10

This week

  • Conduct comprehensive review of MSP and third-party vendor access to cloud environments; implement least-privilege principles
  • Establish baseline monitoring for service principal authentication patterns; alert on sequential tenant access or authentication from unexpected locations
  • Implement web application firewall rules to detect command injection attempts in SiteGuard and Drupal endpoints
  • Review backup and disaster recovery infrastructure for security hardening; ensure backup systems are not trusted beyond necessary scope
  • Train development teams on supply-chain attack indicators and secure package management practices

Watch List

  • ConnectWise incident updates: Monitor for additional compromised application IDs, expanded victim notifications, and root cause disclosure
  • Drupal CVE assignment: Watch drupal.org/security for specific CVE identifiers and proof-of-concept exploit publication
  • MALFEX evolution: Track npm publisher accounts (malfexteste series) for new package publications; monitor 104.234.65[.]75 for infrastructure changes
  • MSP targeting trend: Increased focus on managed service provider tools as supply-chain attack vectors; similar campaigns may target other MSP platforms
  • Backup infrastructure attacks: Concurrent targeting of backup solutions (ConnectWise, AOMEI Backupper) suggests coordinated or copycat activity

Sources

  • BleepingComputer: [Hackers exploit SiteGuard WAF flaw to run commands as admins](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/)
  • BleepingComputer: [Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/)
  • BleepingComputer: [Drupal patches critical RCE flaws, warns exploits may emerge soon](https://www.bleepingcomputer.com/news/security/drupal-patches-critical-rce-flaws-warns-exploits-may-emerge-soon/)
  • The Hacker News: [ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants](https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html)
  • The Hacker News: [MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon](https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)
  • The Hacker News: [Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants](https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html)