SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefSunday, October 18, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY ConnectWise Supply Chain Breaches Microsoft 365 | CRITICAL |
|
5 C2 IPs | 95 OTX IOCs | 5 ARTICLES |
|
■ ANALYST TLDR Today's intelligence highlights critical supply chain compromises impacting Microsoft 365 tenants via ConnectWise Cloud Backup and a malicious npm package. Additionally, Drupal has patched severe RCE flaws, and sophisticated zero-click spyware from Candiru is being delivered via an Israeli ad firm, underscoring the diverse and persistent threat landscape. |
|
■ CRITICAL STORIES Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack A compromised ConnectWise Cloud Backup credential led to unauthorized access to application identities and 173 Microsoft 365 tenants, posing a significant supply chain risk for MSPs and their clients. |
Drupal patches critical RCE flaws, warns exploits may emerge soon Two critical Remote Code Execution vulnerabilities in Drupal require immediate patching to prevent attackers from compromising websites running the CMS. |
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon A malicious npm package is part of the MALFEX supply chain campaign, delivering a shellcode loader via a Windows native addon, threatening developers and their projects. |
Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel Discover-Tech's ad infrastructure is being exploited to fingerprint devices and deliver Candiru's zero-click spyware, enabling highly targeted surveillance. |
|
■ CVEs IDENTIFIED [CVE-TBD] ConnectWise Cloud Backup / Microsoft 365 — Supply-chain compromise, tenant access via compromised credential. |
[CVE-TBD] Drupal — Remote Code Execution (RCE) flaws. |
[CVE-TBD] imgdecode (npm package) — Software supply chain attack, shellcode loader delivery. |
[CVE-TBD] Discover-Tech / Candiru — Zero-click spyware delivery, device fingerprinting. |
|
■ THREAT ACTORS Compromised ConnectWise credentials to breach Microsoft 365 tenants. |
Unknown threat actors | Unnamed |
Abusing ConnectWise credential for M365 tenant access. |
MALFEX campaign actors | Unnamed |
Deploying malicious npm packages like 'imgdecode'. |
|
|
|
■ ATT&CK TTPs | T1195.002 | | Supply Chain Compromise: Software Component | ConnectWise Cloud Backup used as initial access. |
| T1078 | | Valid Accounts | Compromised ConnectWise credential used for M365 access. |
| T1526 | | Application Access Token | Hackers accessed application identities in M365. |
| T1190 | | Exploit Public-Facing Application | RCE vulnerabilities in Drupal. |
| T1195.001 | | Supply Chain Compromise: Compromise Software Dependencies and Development Tools | Malicious 'imgdecode' npm package. |
| T1059 | | Command and Scripting Interpreter | Shellcode loader within 'imgdecode'. |
|
■ PATCH PRIORITY Drupal — RCE vulnerabilities, exploits expected soon — BC |
Microsoft 365 / ConnectWise Cloud Backup — Supply chain compromise, widespread tenant access — BC, THN |
npm / imgdecode — Malicious package delivering shellcode loader — THN |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately patch all supported versions of Drupal to address the critical RCE vulnerabilities ([CVE-TBD]). Prioritize web-facing Drupal instances. |
| 2 | [P1] Investigate and audit all Microsoft 365 tenants connected via ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) for signs of compromise, credential rotation, and application identity review related to the [CVE-TBD] ConnectWise breach. |
| 3 | [P2] Developers should review their npm dependencies for the malicious 'imgdecode' package ([CVE-TBD]) and similar suspicious packages, implementing strict supply chain security practices. |
| 4 | [P2] Implement robust endpoint detection and response (EDR) solutions to detect shellcode execution and anomalous activity, especially on Windows systems, to mitigate threats like the 'imgdecode' [CVE-TBD] package. |
| 5 | [P3] Enhance network monitoring and implement ad blockers to reduce exposure to potential drive-by compromises and fingerprinting attempts from ad networks like Discover-Tech, which can deliver sophisticated spyware like Candiru's [CVE-TBD]. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |