One Key, 173 Victims: The ConnectWise Breach Everyone Should Know About
Sunday, October 18, 2026 · 5-minute read
The United Kingdom has sanctioned Cryptomus — a cryptocurrency payment platform tied to ransomware payments, drug markets, and other criminal activity that has helped Russia dodge existing financial restrictions. Also known as Certa Payments, Xeltox Enterprises, and now Heleket, the platform has processed over $7 billion in transactions since 2022, according to blockchain analysts at TRM Labs. The sanctions freeze any Cryptomus assets held at UK banks and bar British companies from doing business with it.
↗ Krebs on SecurityThe FBI arrested a Canadian cybersecurity executive in Pennsylvania this month on charges connected to the ShinyHunters group — the same crew that recently stole sensitive data on thousands of FBI agents. The suspect was attending a cyber insurance conference in Philadelphia and reportedly worked at a firm specializing in ransomware negotiations. Federal court records show he faces charges of cyber extortion and conspiracy, though key documents have since been sealed.
↗ Krebs on SecurityMicrosoft released security updates this week covering a staggering 1,411 vulnerabilities across Windows and other products — smashing September's record of nearly 1,000 fixes. One flaw is a confirmed zero-day: CVE-2026-96951, a security bypass in Windows Shell affecting Windows 10 and 11. Windows 10 users who were worried about losing updates can breathe a little easier — Microsoft quietly extended free support to October 2027.
↗ Krebs on SecurityHackers got hold of a credential belonging to ConnectWise Cloud Backup — a service that managed service providers use to back up their clients' Microsoft 365 data. Because that one credential has broad, pre-approved access to mailboxes, files, Teams, and SharePoint across every customer that installed the app, attackers were able to quietly sign in to 173 separate organizations' Microsoft 365 environments without needing each company's individual password. ConnectWise pulled the plug on the service on October 17 and disabled seven connected application identities, but the investigation is still ongoing.
This is a textbook supply-chain attack. The attackers didn't need to break into 173 companies separately — they broke into one trusted vendor and got access to all of them at once.
Between May and July 2026, attackers repeatedly hijacked AOMEI Backupper's update servers in short bursts — just five to ten minutes at a time — swapping out legitimate update files for a backdoor. Any Windows PC that checked for an update during one of those windows automatically downloaded and ran the malicious file. Google's Threat Intelligence Group and Mandiant disclosed the campaign this week. AOMEI says it has fixed its servers, but the fix does nothing for machines that already picked up the bad update.
A flaw in the BlockStrap extension for Magento and Adobe Commerce lets an attacker run any PHP code they want on a store's server — essentially giving them full control of the site. Researchers warn that working exploits could appear soon, putting online stores and their customers' payment data at serious risk.
Status: Patch available — store owners running Magento or Adobe Commerce with the BlockStrap extension should update immediately.
Attackers are actively exploiting a flaw in the Collabora Online document editing app for Nextcloud. The bug lets hackers run commands directly on the server — meaning they can steal files, plant malware, or take full control of a self-hosted file storage setup.
Status: Actively exploited in the wild. If you run Nextcloud with the Collabora Online (richdocumentscode) app, update it now.
BeyondTrust's Remote Support software — used by IT teams to connect to and fix employees' computers remotely — has a critical flaw that attackers have been exploiting since late August. CISA has urged all organizations using the product to patch immediately. BeyondTrust issued the fix this week, but attackers had a roughly seven-week head start.
Status: Patch now available. CISA has added this to its Known Exploited Vulnerabilities catalog.
Google has started rolling out new AI-powered protections on Android that watch for scam messages and call-forwarding abuse in real time. The system looks for patterns common in fraud — like fake delivery texts or calls that try to redirect you to a scammer — and flags or blocks them before you interact. This is a meaningful step up from basic spam filters, because the AI can catch novel scam scripts that haven't been seen before. The feature is rolling out now to eligible Android devices.
Ledger, the company behind popular hardware crypto wallets, has confirmed that a covert spy chip implanted in some devices was the cause of recent thefts from customers. Hardware-level implants — tiny chips added during manufacturing or shipping — are extremely rare in consumer devices and represent a sophisticated attack. This is a wake-up call for anyone who buys hardware security devices: the supply chain for physical products can be tampered with too, not just software.
Imagine giving a trusted property manager a master key to every apartment in your building. It's convenient — until someone steals that key. That's roughly what happened this week with ConnectWise Cloud Backup, and it affected 173 companies simultaneously.
ConnectWise Cloud Backup (formerly known as SkyKick) is a tool that managed service providers use to back up their clients' Microsoft 365 data — emails, OneDrive files, Teams chats, SharePoint documents. To do that job, the app is granted sweeping permissions inside every customer's Microsoft 365 environment when it's first installed. That's normal. The problem is that all of those permissions are tied to a single set of app credentials — essentially one master key. When attackers got hold of that key, they didn't need to break into each of the 173 organizations separately. They just walked through every door at once.
Security researchers at Huntress spotted the unauthorized sign-ins first, confirming access across 173 partner and customer tenants. ConnectWise responded on October 17 by disabling seven connected application identities and shutting down the Cloud Backup service entirely. That stopped the bleeding. But it also knocked out the backup service for every customer — meaning the fix itself caused disruption.
This attack follows a pattern that's becoming more common: instead of targeting individual companies, attackers go after the software vendors those companies trust. One successful breach gives them access to dozens or hundreds of targets. The IT industry calls this a supply-chain attack, and it's why security experts increasingly say that vetting your vendors — not just your own systems — is essential. The ConnectWise investigation is ongoing. If your organization uses any ConnectWise product, keep a close eye on updates from the company this week.