2026年10月20日の
セキュリティ情報

Subject: [Security Alert] Unauthorized Access via ConnectWise Application Credentials

Dear IT Administration Team,

We are sharing information regarding a security incident involving ConnectWise services.

■ Overview
Attackers compromised seven application identities within ConnectWise, using these credentials to impersonate trusted applications and request access tokens from Microsoft Entra ID. This allowed them to attempt unauthorized access to customers' Microsoft 365 services, including Exchange Online, SharePoint, Teams, and Directory Data.

■ Scope
- ConnectWise Cloud Backup (formerly SkyKick)
- ConnectWise SaaS Security
- ConnectWise Cloud Management
- Linked Microsoft 365 Tenants

■ Action Items
1. Verify if your organization utilizes the affected ConnectWise services.
2. Review Microsoft Entra ID audit logs for any suspicious activity or unauthorized API calls originating from ConnectWise application identities.
3. Monitor official ConnectWise communications for recovery updates and root cause analysis.

■ Reference
- ConnectWise Official Advisory / thaicert

Priority: High
Deadline: Immediate review

Subject: [Security Alert] Password Strength and Account Management

Hi everyone,

A recent security breach at another organization was caused by a forgotten test account using an extremely weak password (e.g., 'Password1'), leading to a significant data leak.

To keep our data safe, please do the following:
1. Review your passwords and ensure you are not using simple words or predictable patterns (e.g., Password123). Change them if necessary.
2. If you have created any test accounts or tools in the past that are no longer in use, please report them to the IT team for deletion.

Deadline: By the end of this week