October 18, 2026

Limited coverage centers on identity-mediated access at two different boundaries: hiring workflows and cloud application identities. The developments should remain distinct because one concerns an alleged worker-placement scheme, while the other is an incident under investigation. [1][2]

What happened

ConnectWise said it disabled seven application identities while investigating an incident in which unknown threat actors gained unauthorized access to those identities and compromised Microsoft 365 tenants. [2]

ConnectWise Cloud Backup is listed among the disabled application identities. [2]

Why it matters

The reported containment action does not establish the incident’s scope beyond the identified application identities and tenant compromises. [2]

What happened

U.S. authorities announced coordinated actions against a North Korean scheme that placed fake remote IT workers inside American companies; two U.S. nationals were arrested, 14 people were charged, and more than 40 Texas residences were searched. [1]

Investigators seized approximately 187 laptops and KVM devices that companies had shipped to remote hires; facilitators installed remote-access software so North Korean workers could use the equipment. [1]

Why it matters

The targeted employers included healthcare, communications, cybersecurity support, retail, and manufacturing organizations, while the workers used stolen or fake identities and VPNs or proxy servers to appear U.S.-based. [1]