Hey all,
I recently published a new video outlining the recent CW breach where I recreated the attack chain live in a tenant. The big takeaway is that this could happen with any app you've granted access to in your M365 environment so don't think this doesn't apply to you if you don't leverage CW/Skykick. I made some resources you all can leverage to:
1. Protectively protect you tenant from these attacks
2. An IR plan you can activate if this every happens with a vendor you have in tenants in the future.
Any of you impacted by this event?