ConnectWise backup app breaches 173 Microsoft tenants, Chinese spies exploit BeyondTrust zero-day, Japan declares first cyber state of emergency

Microsoft 365 Supply-Chain Break-Ins via ConnectWise, US Bankruptcy Notices Down, Phishing Market Takedown, BeyondTrust Zero-Day, Japan Cyber Emergency

Cybersecurity Today Host David Shipley covers multiple incidents: ConnectWise shut down its cloud backup service after an attacker stole the app credential and used its broad Microsoft 365 permissions to access at least 173 customer tenants in a supply-chain attack, with guidance to disable affected apps and review service principal sign-ins.

A cyberattack on BAE Systems knocked out the U.S. federal Bankruptcy Noticing Center, halting all bankruptcy notices with no restoration timeline. Microsoft and Health ISAC seized domains of three Chinese-language phishing marketplaces tied to over a billion malicious messages and disabled thousands of related accounts.

Forescout detailed Romulus, a ClickFix-based malware delivery platform serving LegionLoader and other payloads. Google/Mandiant reported Armory Castle exploiting a BeyondTrust Remote Support zero-day (CVE-2026-102764).

Japan declared its first-ever cybersecurity state of emergency after a breach and cascading ransomware impacts.

00:00 Top Stories Preview

00:34 ConnectWise Backup Breach

02:54 Bankruptcy Courts Outage

04:37 Phishing Markets Takedown

06:28 Romulus Malware Platform

08:54 BeyondTrust Zero Day

11:28 Japan Cyber Emergency