Incident Watch: Real-Time SaaS Threat Reports & Attack Analysis

Incident watch

Tenant Spray - Wider SaaS Supply Chain Targeting Beyond ConnectWise

In mid-October, an attacker used stolen ConnectWise credentials to request access tokens for Microsoft 365 tenants, including many that never had the app installed. Huntress, Todyl, and ConnectWise have published their findings. On October 21 Microsoft attributed the activity to Storm-0940, a China-state-aligned actor.

October 23, 2026

40% of your agents are a critical risk. Read the CISO Playbook for Securing AI Agents

Announcing our Series D to fuel agentic productivity, securely

Incident Watch

Tenant Spray - Wider SaaS Supply Chain Targeting Beyond ConnectWise

Scattered Spider Now Targeting Airlines and Transportation, FBI Warns of Imminent Data Theft

16 Billion Passwords Leaked Online in Record Data Breach

UNC6040 Vishing Campaigns Targets Salesforce for Data Theft

Tenant Spray - Wider SaaS Supply Chain Targeting Beyond ConnectWise

The Impact of the Trivy Supply Chain Attack: Second Stage Exploitation

The Kill Switch Inside Intune: How Iran-Backed Hackers Used a SaaS Breach to Disrupt Stryker Operations

Void Arachne (Silver Fox APT) Targets Taiwanese Government & Tech Firms in Spear‑Phishing‑Driven Espionage Campaign

UNC2452 Targets Government IT Supply Chain in Supply‑Chain Espionage Campaign

APT34 (OilRig / Helix Kitten) Targets Middle Eastern Government Email Infrastructure via Power Exchange Server Backdoor

BlindEagle (APT‑C‑36) Targets Latin American Entities in Spear‑Phishing‑Driven Espionage Campaign

Scattered Spider Targets Airlines & Retail in Social‑Engineering‑Driven Cyberattack

APT28 (Fancy Bear) Russian Military Intelligence Targets Western Logistics Supporting Ukraine

APT41 (Barium / Salt Typhoon)Targets Telecom Providers via Kernel‑Level Backdoor Espionage Campaign

APT29 (Cozy Bear/Midnight Blizzard) Targets Diplomatic IT via Token‑Theft‑Driven Espionage Campaign

APT32 (OceanLotus) Targets Dissidents & Corporate Media via Fake‑Site‑Driven Espionage Campaign

APT33 (Elfin Team) Targets Aerospace & Energy Firms via Spear‑Phishing‑Driven Espionage Campaign