SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefMonday, October 19, 2026 INTEL CONFIDENCE 64% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY ConnectWise App Identifiers Compromised to Breach M365 Tenants | CRITICAL |
|
5 C2 IPs | 0 OTX IOCs | 4 ARTICLES |
|
■ ANALYST TLDR Threat actors are actively exploiting an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF to gain root or SYSTEM privilege execution on vulnerable web application firewalls. Concurrently, ConnectWise has suspended seven application identities after attackers compromised them to gain unauthorized access into customer Microsoft 365 tenants. Security teams are also advised to inspect AutoCAD DWG files for hidden malicious payloads leveraging orphaned VBA projects. |
|
■ CRITICAL STORIES Hackers exploit SiteGuard WAF flaw to run commands as admins Active exploitation of an OS command injection flaw allows remote attackers to gain full root or SYSTEM control over security infrastructure. |
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants Malicious actors compromised seven ConnectWise application identities to breach downstream customer Microsoft 365 cloud environments. |
Orphaned VBA Projects Inside DWG Files: YARA Rule Attackers are hiding malicious VBA projects inside AutoCAD DWG files to evade standard email gateway and security inspections. |
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars Industry hiring data shows a shift in demand toward specialized AI security roles despite an overall drop in cybersecurity job openings. |
|
■ CVEs IDENTIFIED [CVE-TBD] SiteGuard Server Edition — OS Command Injection allowing command execution as root or SYSTEM |
|
■ THREAT ACTORS Unknown Threat Actors | Cybercrime / APT |
Exploited SiteGuard Server Edition WAF vulnerability for root/SYSTEM RCE |
Unknown Threat Actors | Cybercrime |
Compromised ConnectWise application identities to breach downstream Microsoft 365 tenants |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Exploited OS command injection flaw in public-facing SiteGuard Server Edition WAF |
| T1059 | | Command and Scripting Interpreter | Executed OS commands as admin (root/SYSTEM) on compromised WAF servers |
| T1098.001 | | Application Access Token | Abused compromised ConnectWise application identities to maintain cloud persistence |
| T1078.004 | | Valid Accounts: Cloud Accounts | Gained unauthorized access to target Microsoft 365 customer tenants |
| T1204.002 | | User Execution: Malicious File | Used orphaned VBA code inside DWG files to deceive users and evade security checks |
|
■ PATCH PRIORITY SiteGuard Server Edition — Active exploitation of OS command injection leading to root/SYSTEM command execution [CVE-TBD] — BleepingComputer |
ConnectWise Cloud Backup — Compromised application identities actively exploited to access M365 cloud environments — The Hacker News |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Audit and revoke permissions for all ConnectWise Application Identities connected to Microsoft 365 tenants, and review M365 audit logs for unauthorized third-party access. |
| 2 | [P1] Restrict network management access to SiteGuard Server Edition instances and apply security updates or vendor workarounds immediately for [CVE-TBD]. |
| 3 | [P2] Deploy YARA detection rules on email gateways and endpoint security controls to scan incoming CAD/DWG files for orphaned VBA projects. |
| 4 | [P2] Review OAuth application permissions and enterprise app integrations across all enterprise Microsoft 365 tenants. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |