Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by a threat actor to gain unauthorized access to hundreds of customer M365 environments. The attacker authenticated from a specific IP address on October 15, obtaining Microsoft Graph access tokens and moving through tenants in an automated manner. The ConnectWise Cloud Management MS Teams application was elevated to Global Administrator in at least one case, allowing the attacker to add credentials to other applications, including security tools. The campaign began with password spraying against law firms, followed by role assignments in about 50 tenants, and widespread credential abuse across nearly 1,000 Entra tenants. A second wave targeted 16 tenants in sensitive sectors such as policy, national security, trade, and critical minerals.

This campaign involves the compromise of a Microsoft 365 API credential associated with ConnectWise Cloud Backup (formerly SkyKick). The attacker used this credential to authenticate from IP 144.172.64.128 on October 15, obtaining Microsoft Graph access tokens across hundreds of tenants. The attacker automated tenant targeting by moving through tenants in sorted GUID order. In one instance, the ConnectWise Cloud Management MS Teams application was elevated to Global Administrator, enabling the addition of credentials to other applications, including security tools. Initial activity included password spraying against law firms on October 13-14, followed by role assignments in approximately 50 tenants, culminating in widespread credential abuse. Nearly 1,000 Entra tenants showed sign-in activity from the malicious IP, with over 300 successful authentications. A second targeted wave focused on 16 tenants in critical sectors such as policy, national security, trade, and critical minerals. No patch or remediation details are provided, and the campaign is ongoing as of the report date.

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.

A Microsoft 365 API credential belonging to ConnectWise Cloud Backup (formerly SkyKick) was compromised and used by a threat actor to gain unauthorized access to hundreds of customer M365 environments. The attacker authenticated from a specific IP address on October 15, obtaining Microsoft Graph acc

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Threats Tagged 'skykick'