II Cyber Warfare & Critical Infrastructure·Analysis·Americas
Attackers no longer break the door; they borrow the supplier's key
Three incidents in three days pointed to the same entry point. A backup app's identity opened 173 tenants, a remote support tool was exploited for seven weeks, and Japanese leaks came from payment and cloud side layers. Defence's blind spot is not the user but the software the user trusts.
Cyber & Critical Infrastructure Desk · 18 October 2026 · 7 min read · 6 sources
Why it matters
The noise is that leaked record counts keep setting new highs. The signal is that attackers are not using employee passwords. They are signing in with the identity of a supplier application that organisations had already granted broad permissions. In the ConnectWise case, a window of 2 hours 21 minutes on 15 October was enough to enter 173 tenants without ever meeting multi-factor authentication. The constraint is not password hygiene but the permissions inventory: most organisations do not know which app holds what rights, or who granted them.
Implications
- As of 17 October Huntress had confirmed unauthorised sign-ins to 173 Microsoft 365 tenants using a stolen ConnectWise Cloud Backup identity; in at least one, privileges were raised to Global Administrator.
- A flaw in BeyondTrust's remote support tool had been exploited since 29 August; Mandiant tied the attack to a Chinese state-backed espionage group, and it was confirmed on 16 October.
- On 16 October Yamato disclosed that 5.31 million records had been taken from a payment service, and Nikkei that 1.83 million records had been seized from a development cloud.
Noise
Leaks are breaking records, so the problem is the record count.
Signal
Attackers bypass multi-factor authentication entirely by using a supplier app's identity.
Record counts are the noise; the chain of trust is the signal
The noise is that leaks keep breaking records. In Japan on 16 October, Yamato disclosed 5.31 million records and Nikkei 1.83 million, and the headlines read it as a numbers race. The bigger the figure, the more the response turns to tightening passwords and training staff against phishing.
The signal lies elsewhere. In all three major cases disclosed over the past 72 hours, the attacker did not come through the organisation's front door. Each used the software of a supplier the organisation trusted, that supplier's key, or a service layer attached to it. This route bypasses the wall of multi-factor authentication that has been built around user accounts over the past decade.
The key sits with the app, not the user
According to The Hacker News on 17 October, a credential belonging to ConnectWise Cloud Backup was compromised and used to sign in to customer tenants between 06:13 and 08:34 UTC on 15 October. A tenant is an organisation's own environment inside Microsoft 365. Because the app backs up customers' email, files, Teams chats and directory, it carried read and write permissions over all of that data.
Since the identity belonged to the app, the attacker inherited those permissions intact. No user, device or authentication prompt ever came into play. The attacker moved through the tenants one by one, a few seconds apart. In at least one tenant, another ConnectWise app made itself Global Administrator and wrote new secret keys to two trusted applications. Todyl says that even after an app is disabled, access tokens already issued stay valid for another 90 minutes. A SpecterOps note from the same day referred to 162 tenants; the figure rose to 173 within the day.
One door, three shapes
The Record reported on 16 October that a privilege escalation flaw in BeyondTrust's remote support appliances had been in use since at least 29 August, and that the company was alerted on 27 September. Mandiant calls the attacker Armory Castle and regards it as a Chinese state-backed espionage group focused on long-term collection. Its targets are law firms, software service providers, outsourcing companies and government bodies. Like the backup app, a remote support tool is a trusted bridge that IT teams install to reach every machine.
In Japan the same pattern shows up in the side layer. According to Kyodo, Yamato's leak came not from its core parcel system but from a post-delivery payment service, and it was detected on 28 September. Jiji reports that Nikkei's 1.83 million records came from a cloud service used in system development. In both cases the data sat in a connected environment that fell outside the security standard of the main system.
Why the constraint has tightened now
The Register's round-up on 17 October cites Dragos counting 1,020 ransomware incidents against industrial organisations in the first quarter of 2026 and 1,140 in the second. The same report says fewer than 10% of operational technology networks are adequately monitored. Armis's October report adds that 73% of organisations run building automation systems that have been used in ransomware attacks.
These figures point to a single structural constraint. As organisations harden user accounts, attackers turn to software identities with broad rights and weak oversight. Backup, remote support and building automation play the same role in three different sectors. Each is the account that reaches everything but that nobody watches day to day.
What comes next
The first marker is ConnectWise announcing that it has rotated its credentials, and Huntress closing its tenant count. The second is whether Microsoft introduces a new alert or default restriction for keys added to service principals. The third is whether new leak disclosures in Japan before the end of October again trace back to a side layer.
Our reading is that the most likely path is a wave of audits of third-party app permissions, which then turns into new clauses in insurance and procurement contracts. The development that would refute this thesis is the ConnectWise case being explained by a user password or employee error. In that event the constraint would be classic account security, not app identity.
Probabilities
Scenarios
| Scenario | Probability | Trigger | Market impact |
|---|---|---|---|
| H1A wave of permission audits | 50% | ConnectWise rotates its credentials, affected tenants stay in the low hundreds, and organisations narrow third-party app permissions. | The incident closes without turning into a data breach, but the permissions inventory becomes a compliance item. |
| H2Backdoors come to light | 30% | The number of tenants with newly written secret keys grows, the BeyondTrust flaw is exploited widely, and data breach disclosures follow. | The incident spreads beyond a single supplier into a wave of espionage and data breaches across legal, software and public bodies. |
| H3A contained incident | 20% | ConnectWise confirms no data was taken, the BeyondTrust patch is applied quickly, and no new major leak is disclosed in Japan. | The incidents close one by one and trigger no structural change. |
Module A
Constraints Matrix
STRUCTURAL AVG 4.0 · TACTICAL AVG 2.7Structural constraints dominate: the outcome is set more by these limits than by the actors' preferences.
Hard structural constraintspersistent · beyond the actors' will
App identity bypasses authentication
5/5Because the credential belonged to the app, multi-factor authentication never triggered across 173 tenants; the attacker inherited previously granted permissions such as Directory.ReadWrite.All.
The remote support tool's privilege · China
4/5The BeyondTrust flaw was used for about 7 weeks, from 29 August until confirmation on 16 October; the tool is a bridge to every endpoint.
Data held in side layers · Japan
4/5Roughly 8 years of data accumulated since 1 October 2018 in Yamato's payment service, and 1.83 million records in Nikkei's development cloud, sat outside the main system.
Lifespan of issued tokens
3/5Todyl says issued access tokens stay valid for up to 90 minutes even after an app is disabled; the response window favours the attacker.
Tactical frictiontemporary · eases over time
Unclear origin of the credential weeks
3/5ConnectWise has not explained how the credential was stolen, so organisations cannot gauge the same risk in other supplier apps.
Monitoring gap in operational technology months
3/5Dragos says fewer than 10% of operational technology networks are adequately monitored; 30% of 2025 responses began with staff noticing, not an alert.
Tenant count still moving days
2/5Huntress put the figure at 162 tenants on 16 October and 173 on 17 October; the scope of the incident is not yet settled.
Module B
Signal vs Noise
SIGNAL 60% · NOISE 40%
- NOISE
Leaks are breaking records, so the problem is the record count.
Yamato disclosed 5.31 million records and Nikkei 1.83 million; in both cases the data came not from the main system but from connected layers such as payments and a development cloud.
nippon.com (Jiji) — More Japanese Firms Disclose Details of Data Breaches
- SIGNAL
Attackers bypass multi-factor authentication entirely by using a supplier app's identity.
A single app identity entered 173 tenants between 06:13 and 08:34 UTC on 15 October; in one tenant privileges were raised to Global Administrator.
- SIGNAL
State-backed espionage is using the same trusted bridge.
The flaw in BeyondTrust's remote support tool has been exploited since 29 August; Mandiant identified the group as the Chinese state-backed Armory Castle.
The Record — Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
- NOISE
The attack on French supermarkets was the work of a state.
Former US Homeland Security official Matt Hayden thinks the attacks were opportunistic rather than state-run; the attacker has still not been named.
The Register — Cybercrims go beyond stealing data to attack physical building systems
- SIGNAL
Industrial ransomware incidents are rising quarter on quarter.
Dragos counted 1,020 incidents in the first quarter of 2026 and 1,140 in the second; fewer than 10% of operational technology networks are adequately monitored.
The Register — Cybercrims go beyond stealing data to attack physical building systems
Module C
Asset-Class and Positioning Implications
| Asset class | Exposure | Transmission channel | H1 | H2 | H3 | Expected | Conviction | Horizon | What to watch |
|---|---|---|---|---|---|---|---|---|---|
| Equities | Identity and access management software | Rising demand for audits of app permissions and service identities | + | ++ | 0 | +1.10 | ●●● | 3–12 months | A Microsoft announcement of new default restrictions on app permissions |
| Equities | Managed service and IT support software providers | Service outages, customer losses and litigation risk | − | −− | 0 | −1.10 | ●●● | 0–3 months | Confirmed data breach disclosures in the ConnectWise and BeyondTrust cases |
| Freight & insurance | Cyber insurance premiums | Third-party app risk being written into policy terms | + | ++ | 0 | +1.10 | ●●● | 3–12 months | Insurers' clauses on third-party apps and supplier audits |
| Volatility | Broad equity volatility | Risk premium widens if a supplier-driven incident spreads to government and finance | 0 | + | 0 | +0.30 | ●●● | 0–3 months | The volatility index at the 25 threshold |
Second-order effects
And then what?
Starting point
On 15 October a backup app's stolen identity opened 173 Microsoft 365 tenants without meeting multi-factor authentication; ConnectWise disabled the app.
- 1
Managed services and cloud operationswithin days
Managed service providers disable third-party apps en masse and audit keys added after 13 October; backup and management services pause temporarily for their customers.
Watch: The date ConnectWise restores app access and its credential rotation announcement
- 2
Cyber insurance and platform ruleswithin months
Platform providers and insurers treat app permissions as a new risk line, demanding extra conditions and audits for apps that hold broad directory write rights.
Watch: A Microsoft announcement of new default restrictions on app permissions, and third-party app clauses in cyber policies
- 3
Supplier concentrationwithin months
Supplier audits get costlier for small organisations, and the managed services market consolidates into fewer, larger providers. Turkish SMEs that outsource cloud backup carry the same permission model and so face the same compliance burden.
Watch: Merger announcements in managed services from October to December, and provider price changes
What breaks the chain
The chain stops at its first step if the ConnectWise case is explained by a classic user account breach, or if it is confirmed that no data was taken. Microsoft making conditional access for app identities the default would settle the second step without leaving it to insurers.
Triggers
Thresholds to watch
| Indicator | Threshold | Today | What it means |
|---|---|---|---|
| VIX volatility index | > 25 | 16.46 | The volatility index rising above 25 would show supplier-driven cyber incidents moving beyond a sector compliance cost and into an event that shifts broad risk appetite. |
Sources
- The Hacker News — Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
- SpecterOps — ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant
- The Record — Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
- Kumamoto Nichinichi Shimbun (Kyodo) — Yamato Transport leaks 5.31 million records, including customer names and addresses, after unauthorised access
- nippon.com (Jiji) — More Japanese Firms Disclose Details of Data Breaches
- The Register — Cybercrims go beyond stealing data to attack physical building systems
Sourcing and verification rules: methodology · Report an error: contact
Related reports
IVMacro & Debt·Analysis·Americas
Interest is now the main engine of the US deficit
The US closed fiscal 2026 with a 1.992 trillion dollar deficit, and two-thirds of its growth came from interest. The average rate on the debt is 3.53% against a 10-year yield of 5.09%; as that gap closes, the bill grows regardless of what the Fed decides.
Macro & Debt Markets Desk · 18 October 2026 · 9 min
IVMacro & Debt·Analysis·Americas
Central banks pause in October as energy persistence decides December
The Fed, the ECB, the Bank of England and the Bank of Canada are reacting to the same energy shock at different speeds. Markets price a pause at the 28–29 October meetings. The real decision rests on November data showing whether energy has reached services prices.
Macro & Debt Markets Desk · 17 October 2026 · 9 min
IVMacro & Debt·In-depth analysis·Americas
Inflation ran hot, Treasuries rallied, and credit markets now bind the Fed
US producer inflation rose to 6.3% on 15 October, yet the 10-year yield fell 10 basis points the same day. Strain in AI debt has begun to constrain the Fed's rate decision more tightly than inflation does.
Macro & Debt Markets Desk · 16 October 2026 · 12 min