> InfoSec News Nuggets – 10/20/2026

ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users ConnectWise has suspended its Cloud Backup service, formerly SkyKick, along with connected SaaS Security and Cloud Management services, after attackers abused a compromised credential tied to the app’s trusted OAuth integration to sign in to customers’ Microsoft 365 tenants. Microsoft Threat Intelligence confirmed it is tracking the active supply chain attack, noting the hacker likely leveraged permissions customers had already granted the multitenant application and attempted to add credentials for backdoor persistence. Huntress reported confirmed unauthorized access in more than 160 customer tenants and said the attackers successfully breached over 300 of the 1,000-plus accounts they targeted. ConnectWise says there is no evidence partner backup data was compromised and is urging security teams to preserve sign-in and audit logs, review application credentials and federation trusts, and check for malicious mailbox forwarding or inbox rules.   ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan Siemens has patched a high-severity DLL sideloading vulnerability in Siemens Software Center, tracked as CVE-2026-110936 (CVSS v4 8.4), after confirming it was exploited in ClickFix social engineering campaigns. Attackers bundled a genuine, validly signed copy of the application with a malicious “archive.dll” placed alongside it, launching the chain via msiexec and an MSI installer to ultimately deploy a remote access trojan. The activity has been linked to the ROMULUS ClickFix delivery platform, and Huntress observed some campaigns using malicious ChatGPT Custom GPTs to steer victims to the fake lure pages. Organizations should update to version 4.0.9.8 or later, block the published indicators of compromise, and hunt for SiemensSoftwareCenter.exe running from AppData\Local\Programs when spawned by msiexec.exe.   Bullhorn takes staffing platform offline to contain cyberattack Staffing and recruitment software provider Bullhorn, which serves more than 10,000 customers worldwide, has disabled access to its platform after a cyberattack triggered a system-wide outage. Problems first surfaced on Friday with job posting issues before the company confirmed a cyber incident and took systems offline to contain it, bringing in CrowdStrike to assist with security reviews ahead of restoration. Major outages are affecting ATS/CRM, automation, back office, and the talent platform, while many other products are running in a degraded state. The company says it has not yet determined whether customer data was exfiltrated, and it is requiring password resets for non-SSO users and rotation of API passwords to protect integrations.   China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns Google is warning that Armory Castle, a suspected China state-sponsored espionage group, exploited a critical BeyondTrust Remote Support vulnerability, CVE-2026-102764 (CVSS 9.3), as a zero-day beginning in August before it was patched on October 8 and publicly disclosed on October 15. After gaining access, the actors deployed a lightweight PHP webshell called Sawfly, planted a SUID root backdoor, attempted to pull credentials from the appliance’s native secrets database, and elevated a compromised account’s Jump Item permissions to Administrator for persistent access to downstream systems. They also used a tunneler named Bareclaw and systematically wiped logs to evade detection. Google urges customers to patch immediately, rebuild appliances of unknown status from clean images, and rotate credentials, cautioning that broader opportunistic exploitation is likely now that the flaw is public.   Cyberattack throws US bankruptcy courts into chaos nationwide: What does it all mean? A cyberattack on BAE Systems, the contractor that operates the federal judiciary’s Bankruptcy Noticing Center, has knocked offline the system responsible for producing and sending official notices for every US bankruptcy court. The Administrative Office of the US Courts says all BNC websites and the related noticing process are unavailable, and bankruptcy courts in roughly 20 states plus Puerto Rico have issued notices warning of delays, temporary procedures, and postponed creditor meetings and hearings. BAE says the incident is isolated to the BNC system, but officials have not said who is responsible or whether sensitive bankruptcy records and financial data were accessed. The disruption raises the risk of missed deadlines for debtors and creditors, and any stolen non-public filings could fuel targeted phishing, identity theft, or extortion. The post InfoSec News Nuggets – 10/20/2026 appeared first on AboutDFIR - The Definitive Compendium Project.