[SecurityIntel] 19 Oct

SECURITYINTEL DAILY BRIEF ■ Threat Intel Brief Monday, October 19, 2026 INTEL CONFIDENCE 64% THREAT LEVEL CRITICAL THREAT OF THE DAY ConnectWise App Identifiers Compromised to Breach M365 Tenants CRITICAL 5 C2 IPs 0 OTX IOCs 4 ARTICLES ■ ANALYST TLDR Threat actors are actively exploiting an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF to gain root or SYSTEM privilege execution on vulnerable web application firewalls. Concurrently, ConnectWise has suspended seven application identities after attackers compromised them to gain unauthorized access into customer Microsoft 365 tenants. Security teams are also advised to inspect AutoCAD DWG files for hidden malicious payloads leveraging orphaned VBA projects. ■ CRITICAL STORIES CRITICAL #1 Hackers exploit SiteGuard WAF flaw to run commands as admins Active exploitation of an OS command injection flaw allows remote attackers to gain full root or SYSTEM control over security infrastructure. HIGH #2 ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants Malicious actors compromised seven ConnectWise application identities to breach downstream customer Microsoft 365 cloud environments. INFO #3 Orphaned VBA Projects Inside DWG Files: YARA Rule Attackers are hiding malicious VBA projects inside AutoCAD DWG files to evade standard email gateway and security inspections. INFO #4 US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars Industry hiring data shows a shift in demand toward specialized AI security roles despite an overall drop in cybersecurity job openings. ■ CVEs IDENTIFIED [CVE-TBD] SiteGuard Server Edition — OS Command Injection allowing command execution as root or SYSTEM Critical ■ THREAT ACTORS Unknown Threat Actors Cybercrime / APT Exploited SiteGuard Server Edition WAF vulnerability for root/SYSTEM RCE Unknown Threat Actors Cybercrime Compromised ConnectWise application identities to breach downstream Microsoft 365 tenants ■ ATT&CK TTPs T1190 Exploit Public-Facing Application | Exploited OS command injection flaw in public-facing SiteGuard Server Edition WAF T1059 Command and Scripting Interpreter | Executed OS commands as admin (root/SYSTEM) on compromised WAF servers T1098.001 Application Access Token | Abused compromised ConnectWise application identities to maintain cloud persistence T1078.004 Valid Accounts: Cloud Accounts | Gained unauthorized access to target Microsoft 365 customer tenants T1204.002 User Execution: Malicious File | Used orphaned VBA code inside DWG files to deceive users and evade security checks ■ PATCH PRIORITY [P1 PATCH NOW] ≤24h SiteGuard Server Edition — Active exploitation of OS command injection leading to root/SYSTEM command execution [CVE-TBD] — BleepingComputer [P2 PATCH NOW] ≤72h ConnectWise Cloud Backup — Compromised application identities actively exploited to access M365 cloud environments — The Hacker News ■ RECOMMENDED ACTIONS TODAY 1 [P1] Audit and revoke permissions for all ConnectWise Application Identities connected to Microsoft 365 tenants, and review M365 audit logs for unauthorized third-party access. 2 [P1] Restrict network management access to SiteGuard Server Edition instances and apply security updates or vendor workarounds immediately for [ CVE-TBD ]. 3 [P2] Deploy YARA detection rules on email gateways and endpoint security controls to scan incoming CAD/DWG files for orphaned VBA projects. 4 [P2] Review OAuth application permissions and enterprise app integrations across all enterprise Microsoft 365 tenants. LIVE IOC FEED C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 PORT 8080 STATUS OFFLINE MALWARE Emotet COUNTRY US IP ADDRESS 50.16.16.211 PORT 443 STATUS ONLINE MALWARE QakBot COUNTRY US IP ADDRESS 34.204.119.63 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY US IP ADDRESS 178.62.3.223 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY GB IP ADDRESS 27.133.154.218 PORT 443 STATUS OFFLINE MALWARE QakBot COUNTRY JP FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → IOC SOURCES: AbuseCH Feodo · AlienVault OTX NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB

SECURITYINTEL DAILY BRIEF

Monday, October 19, 2026

ConnectWise App Identifiers Compromised to Breach M365 Tenants

Threat actors are actively exploiting an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF to gain root or SYSTEM privilege execution on vulnerable web application firewalls. Concurrently, ConnectWise has suspended seven application identities after attackers compromised them to gain unauthorized access into customer Microsoft 365 tenants. Security teams are also advised to inspect AutoCAD DWG files for hidden malicious payloads leveraging orphaned VBA projects.

Hackers exploit SiteGuard WAF flaw to run commands as admins

Active exploitation of an OS command injection flaw allows remote attackers to gain full root or SYSTEM control over security infrastructure.

ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Malicious actors compromised seven ConnectWise application identities to breach downstream customer Microsoft 365 cloud environments.

Orphaned VBA Projects Inside DWG Files: YARA Rule

Attackers are hiding malicious VBA projects inside AutoCAD DWG files to evade standard email gateway and security inspections.

US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars

Industry hiring data shows a shift in demand toward specialized AI security roles despite an overall drop in cybersecurity job openings.

SiteGuard Server Edition — OS Command Injection allowing command execution as root or SYSTEM

Unknown Threat Actors

Exploited SiteGuard Server Edition WAF vulnerability for root/SYSTEM RCE

Unknown Threat Actors

Compromised ConnectWise application identities to breach downstream Microsoft 365 tenants

SiteGuard Server Edition — Active exploitation of OS command injection leading to root/SYSTEM command execution [CVE-TBD] — BleepingComputer

ConnectWise Cloud Backup — Compromised application identities actively exploited to access M365 cloud environments — The Hacker News

■ RECOMMENDED ACTIONS TODAY

C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5

FULL IOC EXPORT — GOOGLE SHEET

All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs Updated daily · Export as CSV to import directly into your tools

IOC SOURCES: AbuseCH Feodo · AlienVault OTX NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB