DebugPrivilege @DebugPrivilege

Not active anymore on X. Network Defender. Problem solver with a passion for troubleshooting complex issues. North Sentinel Island Joined February 2017

Tweets

513
Followers

41K
Following

2K
Likes

21K

DebugPrivilege @DebugPrivilege

8 hours ago

@merill @MPECSInc @techspence I thought Entra was secure by default? /s

1 0 4 170 0

View Details

DebugPrivilege @DebugPrivilege

8 hours ago

@Tr3s0r That’s how I did it as well

1 0 2 35 0

View Details

DebugPrivilege @DebugPrivilege

10 hours ago

Yikes!

Susan Bradley @SBSDiva

23 hours ago

@HuntressLabs

1 0 10 3K 4

3 2 22 3K 7

View Details

DebugPrivilege @DebugPrivilege

11 hours ago

@RidgelineCyber Maybe join with 4624 for more accuracy?

0 0 0 92 0

View Details

The Hacker News @TheHackersNews

19 hours ago

🚨 ConnectWise has suspended Cloud Backup and disabled 7 app identities after attackers compromised Microsoft 365 tenants. Backups and restores are unavailable. Previously issued access tokens may remain valid. Read: thehackernews.com/2026/10/connec…

16 36 142 29K 31

View Details

DebugPrivilege @DebugPrivilege

a day ago

@BastionMediaFR @grok Is this recent?

1 0 0 2K 0

View Details

DebugPrivilege @DebugPrivilege

2 days ago

@MikeTalonNYC Yikes!

0 0 0 238 0

View Details

Microsoft Threat Intelligence @MsftSecIntel

2 days ago

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants. ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All. On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities. We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV. Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

6 111 311 33K 165

View Details

DebugPrivilege @DebugPrivilege

2 days ago

@Tr3s0r بِالتَّوْفِيقِ

0 0 1 21 0

View Details

DebugPrivilege @DebugPrivilege

2 days ago

@Tr3s0r Nice.

1 0 1 54 0

View Details

CISA Cyber @CISACyber

5 days ago

🚨 We added Ivanti Connect Secure vulnerability CVE-2026-104935 to the KEV Catalog after observed exploitation. A remote attacker could bypass authentication to execute commands, steal credentials, and exfiltrate data. Update now and review our Alert. 🔗 go.dhs.gov/5Kc

5 34 101 12K 15

View Details

Thomas Seigneuret @_zblurx

4 days ago

Little upgrade on NetExec WMI protocol 🚀 Now NetExec supports SAM, LSA and NTDS dump using only WMI. Thanks a lot to @al3x_n3ff for all the help on this PR (and all the work on NetExec overall, you rock bro 🫶)