The week

ConnectWise Credential Exposes 173 Tenants

A ConnectWise Cloud Backup credential was used to access 173 Microsoft 365 tenants; pause, rotate, and audit delegated credentials now. Multiple active exploits and supply‑chain tampering increase blast radius this week.

Composed by SitRep’s AI editors from 5 sources — The Hacker News, Mandiant Threat Intelligence, Breaches.net, Check Point Research, BleepingComputer

Compromised ConnectWise Credential Hits 173 Tenants

a compromised ConnectWise Cloud Backup credential was used to sign into 173 Microsoft 365 tenants, accessing mail, OneDrive, SharePoint, and Teams; activity observed from IP 144[.]172[.] on Oct 15 between 06:13–08:34 UTC. ConnectWise paused Cloud Backup access to contain abuse—rotate delegated credentials and audit Graph token usage immediately.

Context

This week’s incidents show adversaries abusing trusted services (delegated credentials, remote‑support appliances, and update servers) to gain broad access. Organizations using ConnectWise Cloud Backup, BeyondTrust Remote Support, AOMEI update mechanisms, or self‑hosted LLM gateways are exposed; blast radius includes tenant‑wide Microsoft 365 data, enterprise servers, and potentially millions of records.

“The through‑line: rotate delegated credentials, validate update paths, and prioritize high‑risk patches now.”

The move

5 things to do today

Rotate all ConnectWise Cloud Backup credentials and revoke existing Microsoft Graph tokens; audit sign‑ins and mailbox/SharePoint/OneDrive/Teams access for Oct 15 activity from IP 144[.]172.
Patch BeyondTrust Remote Support for CVE-2026-102764 and hunt for SAWFLY and BARECLAW indicators and evidence of log deletions.
Upgrade LiteLLM installations to 1.83.9 (addresses CVE-2026-35029 and CVE-2026-59823), restrict access to POST /config/update, and monitor for unauthorized file reads.
Apply Drupal core updates (10.6.19, 11.3.19, or 11.4.10) and Entity List 3.0.10 or uninstall Field UI immediately to mitigate CVE-2026-108097 and CVE-2026-108099.
Validate AOMEI update signature checks and restrict update endpoints; monitor for short (5–10 minute) anomalous redirects or unexpected downloads indicative of CROSSROAD/SHINYROAD activity.

On the wire

P0Identity

Rotate and Audit Delegated ConnectWise Credentials Immediately

A compromised ConnectWise Cloud Backup credential granted access to 173 Microsoft 365 tenants and generated Microsoft Graph tokens (observed from IP 144[.]172[.]). Rotate all ConnectWise Cloud Backup credentials, revoke existing Graph tokens, and review sign‑in logs and mailbox/SharePoint/OneDrive access for anomalous activity.

THE HACKER NEWS · Attack Involves Compromised ConnectWise Credential Accessing 173 Microsoft 365 Tenants

P0Ransomware/Exploit

Investigate BeyondTrust CVE-2026-102764 Exploitation Artifacts

Mandiant links ARMORY CASTLE to active exploitation of BeyondTrust Remote Support (CVE-2026-102764) using SAWFLY webshell and BARECLAW tunneler for escalation and persistence—apply vendor patches, search for SAWFLY/BARECLAW indicators, and inspect logs for deletion or tampering.

MANDIANT THREAT INTELLIGENCE · Armory Castle Exploits BeyondTrust CVE-2026-102764 Using SAWFLY

P1Supply Chain

Validate AOMEI Update Paths and Monitor Short‑Window Tampering

UNC7017 performed five‑ to ten‑minute update tampering windows to redirect AOMEI update/notification files to CROSSROAD and SHINYROAD payloads—restrict update URLs, enforce cryptographic validation of update packages, and monitor update server traffic for ephemeral redirects or unusual downloads.

MANDIANT THREAT INTELLIGENCE · Ephemeral Supply Chain Tampering Targets AOMEI Update Infrastructure

P1LLM Security

Patch LiteLLM Gateways to 1.83.9 and Harden Admin Endpoints

Check Point found LiteLLM (v1.77.7) with missing RBAC on POST /config/update enabling arbitrary file reads, admin takeover, and RCE via cloud modules (CVE-2026-35029, CVE-2026-59823). Upgrade to LiteLLM 1.83.9, restrict access to management endpoints, and hunt for suspicious POST /config/update traffic and unexpected file reads.

CHECK POINT RESEARCH · LiteLLM Gateways Expose High-Severity Vulnerabilities

P1Patch Management

Apply Drupal Core and Entity List RCE Fixes or Uninstall Field UI

Drupal released fixes for two RCEs (CVE-2026-108097, CVE-2026-108099) affecting Field UI and Entity List; deploy Drupal core 10.6.19 / 11.3.19 / 11.4.10 and Entity List 3.0.10, or remove Field UI if you cannot patch immediately to avoid imminent exploit risk.

BLEEPINGCOMPUTER · Drupal Patches Critical RCE Flaws; Exploits Likely Soon

Indicators named in this edition

Kind	Value	Note
IP	144[.]172[.]	Observed source IP for ConnectWise Cloud Backup sign‑ins to 173 tenants.
CVE	CVE-2026-102764	BeyondTrust Remote Support exploit tied to ARMORY CASTLE.
CVE	CVE-2026-35029	LiteLLM gateway vulnerability enabling file read/admin takeover.
CVE	CVE-2026-59823	LiteLLM SSRF/credential exposure affecting clientside LLM credentials.
CVE	CVE-2026-108097	Drupal Field UI remote code execution.
CVE	CVE-2026-108099	Drupal Entity List remote code execution.
CVE	CVE-2026-96951	Notable Microsoft Patch Tuesday fix (Windows Shell).
CVE	CVE-2026-70229	Microsoft Patch Tuesday fix affecting Windows AD DS RCE.

End of the Saturday, October 17, 2026 weekend edition.