144.172.64[.]128IP address

“let IPs = dynamic(["144.172.64.60", "144.172.64.99", "144.172.64[.]128"]);”

“144.172.64[.]128 - Application sign-ins with a vendor credential (primary vector)”

“On October 15, Huntress observed the ConnectWise Cloud Backup application authenticating from 144.172.64[.]128, rather than the Azure private infrastructure normally associated with the service.”

“It says the stolen credential was used on October 15, between 06:13 and 08:34 UTC, to sign in as the backup application from 144.172.64[.]128, an address belonging to a hosting provider rather than the Microsoft cloud infrastructure the app normally operates from.”

“It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.”

“Huntress identified malicious sign-ins from IP address 144.172.64[.]128 through October 15 at around 14:20 UTC, and a second targeted wave later that same day aimed specifically at 16 tenants in the policy, national security, trade, and critical minerals sectors.”

“All requests originated from 144.172.64[.]128 and used the following User-Agents: Python-urllib/3.12 and python-requests/2.31.”

“As of late Saturday, Huntress said it identified a "second, targeted wave of attempts" from the IP address "144.172.64[.]128" on October 15.”

“"It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.”

“On October 15, the application's identity signed in to customer Microsoft 365 tenants from 144.172.64[.]128, a hosting provider address, and received Microsoft Graph access tokens.”