Microsoft 365

ConnectWise Cloud Backup Incident: Treat SaaS Application Trust as an Incident Boundary

ConnectWise suspended Cloud Backup after unauthorized access to application identities. The defensible response is to hunt application activity in each Microsoft 365 tenant, not to mistake downtime for proof of compromise.

LSHIY Password Spray: ROPC and MFA Gaps in Microsoft 365

A June 2026 password spray from LSHIY LLC's IPv6 range compromised 78 Microsoft accounts across 64 organizations by abusing Azure CLI ROPC sign-ins that MFA policies did not cover.