incident response6 articles
ConnectWise Pulls Cloud Backup Offline After Attackers Hijack Microsoft 365 Tenants
ConnectWise disabled seven application identities and suspended its Cloud Backup and Cloud Management services after unknown threat actors compromised the application credentials and used them to gain unauthorized access to Microsoft 365 customer tenants. The attack is particularly dangerous because the stolen application credentials allowed attackers to authenticate as ConnectWise's own applications and request access tokens from Microsoft Entra ID, potentially enabling access to mailboxes, SharePoint, Teams, and directory data — and even establish persistence by adding new credentials or applications within compromised tenants. Security firm Huntress has confirmed malicious activity across nearly 1,000 Entra tenants, with successful sign-ins in approximately 300, and identified a second targeted wave of attempts focused on 16 tenants in sensitive sectors including national security and critical minerals.
Ransomware Gangs Are Showing Up At Your Door Now. Literally.
Ransomware attackers are increasingly using physical and psychological intimidation tactics — such as sending threatening packages, photos of victims' children's schools, swatting calls, and even abduction threats — to pressure organisations into paying extortion demands. According to a Semperis report, 37% of ransomware attacks involved such threats, with over half of attackers following through on them. Security experts advise victims to stand firm, involve law enforcement early, and never pay, as doing so often leads to repeat attacks.
BIG-IP Malware Hides a Web Shell in RAM, Making Disk Scans Useless
Malware targeting F5 BIG-IP APM appliances, tracked as c05d5254 and linked to CVE-2025-53521 (a critical remote code execution flaw rated 9.8 on CVSS 3.1), evades detection by injecting a PHP web shell into Apache's memory rather than writing it to disk, meaning file scans return clean results. Sophos found that the malware hooks into Apache's internals to intercept PHP file loading, inserting the web shell before the legitimate script content in memory, while also providing a secondary backdoor via a local Unix socket connected to bash. Organizations are advised to run F5's sys-eicheck integrity tool, compare in-memory modules against on-disk copies, and submit a qkview report to F5, as patching alone does not confirm an appliance was not compromised beforehand and the malware may survive firmware upgrades.
Hasbro Breach Exposes Employee Data — Monopoly Money Won't Cover This One
Hasbro has notified employees that their personal information, including names, addresses, phone numbers, national ID numbers, and financial details, may have been compromised in a data breach. The breach likely affects hundreds to a few thousand employees and may be linked to a cyberattack in late March that cost the company $11 million in cleanup expenses and delayed $25 million in product sales. Hasbro states it is unaware of any misuse of the exposed data and is offering identity protection services to those affected.
Unknown Threat Actor Chained SonicWall Zero-Days to Root Before Anyone Knew They Existed
A previously unknown threat actor (UTA0533) exploited two zero-day vulnerabilities — CVE-2026-15409 and CVE-2026-15410 — in SonicWall SMA 1000 series VPN appliances before patches were publicly released, chaining them together to achieve root-level access on compromised devices. The attacker deployed custom malware, including a web shell and HTTP proxy tool, modified startup scripts for persistence, and used packet capture utilities to steal LDAP credentials. While UTA0533 demonstrated advanced capability in compromising the appliances, evidence suggests they had limited success in moving laterally to other systems on the network.
Why Cyber Resilience Has Swallowed Business Continuity Planning
Modern business disruption increasingly originates from cyber threats such as ransomware, identity compromises, and supplier or cloud failures, making cyber resilience the new foundation of business continuity planning. Effective continuity requires organisations to map critical processes and dependencies, integrate governance, incident response, and supplier management into a unified framework, and ensure systems can recover within agreed timeframes. Crucially, continuity plans must be regularly tested against realistic scenarios to verify they hold up under real pressure, not just on paper.