Risky Business · Wednesday, October 21, 2026
Mark Khoury and James Wilson discuss a supply chain-style attack where attackers leveraged a ConnectWise backup application to gain high-level privileges in Microsoft 365 tenants. Attackers abused features like Microsoft Graph API while leaving minimal audit traces.
“folks found that there was a login through that app app. That's installed, but the login didn't come from one of Azure's IP addresses, came from an external one.”
“some of the backdoors were attempted via Microsoft Graph or MS Cloud API. And the Microsoft Graph directory reads, leave no audit records.”