Threat Analysis : Cyber News for Small Business

Airport Breach, Terminal Attacks, and Defender Alert Fatigue Manchester Airports Group has suffered a confirmed data breach larger than initially disclosed, with 86GB of validated customer and travel records now in threat actor hands. UK businesses with corporate travel through Manchester, Stansted, or East Midlands face immediate phishing risk. Meanwhile, the TerminalFix campaign bypasses email d...

Zero-Day Print Server Exploits, Teams Vishing, and Firmware Implants This episode examines three active threats targeting UK small businesses through infrastructure that is often managed inattentively. PaperCut print management servers face active zero-day exploitation with no official vendor patch available, forcing organisations to choose between unvalidated emergency fixes or taking systems off...

NCSC Edge Device Warning, Manchester Airports Breach, and Teams Vishing Today’s briefing examines three urgent threats to UK small businesses. The NCSC has issued a fresh alert on internet-exposed edge devices, highlighting persistent failures in patch management and configuration that attackers are actively exploiting. Manchester Airports Group has confirmed a breach affecting 8.7 million UK cust...

Ubiquiti UniFi Max-Severity Flaws and Gitea Active Exploitation Three maximum-severity vulnerabilities have been disclosed in Ubiquiti’s UniFi network products, all exploitable remotely without authentication. Separately, CISA has confirmed active exploitation of a critical code injection flaw in Gitea, the self-hosted Git service widely used for internal code repositories. Both disclosures highli...

ClickFix Malware, Check Point Bypass, and Zimbra Campaign Hits 270 Servers Three active threats demand immediate attention from UK small businesses today. ClickFix social engineering campaigns have matured into a multi-vector malware ecosystem using MSI packages, NodeJS execution, and fake CAPTCHA lures to deliver persistent backdoors across Windows and macOS systems. Attackers are abusing legitim...

Zimbra Zero-Click RCE, Check Point Bypass, and Device Code Phishing This episode examines three active threats demanding immediate attention from UK small businesses. First, a zero-click remote code execution vulnerability in Zimbra Collaboration Suite (CVE-2025-66376) under active exploitation by Russian-linked threat actors, with a three-day federal patch deadline from CISA. Second, an authentic...

Teams Impersonation and Rust Supply Chain Attacks Hit UK SMBs This episode examines two unconnected but similarly exploitative campaigns targeting UK small businesses in August 2026. The first, SynkLoader, uses Microsoft Teams to impersonate IT helpdesk staff, delivering memory-resident malware through plausible maintenance requests. The attack succeeds because default Teams external access settin...

MLflow Exploitation, NetScaler Emergency Patch, and European Banking Trojan CISA has confirmed active exploitation of a critical MLflow vulnerability, demanding immediate action from any organisation running AI or machine learning infrastructure. The server-side request forgery flaw allows attackers to access internal systems, and deployment patterns mean the platform often sits outside normal sec...

Critical Windows RCE Under Active Exploit, Clop Custom Tooling, and MFA Bypass Phishing This episode covers three active threats with credible paths to UK small businesses. First, CISA has added a critical Windows IKE Extension remote code execution vulnerability to its Known Exploited Vulnerabilities catalogue, confirming active exploitation against network-reachable systems. Second, Clop ransomw...

Windows Task Host Ransomware Exploitation and Microsoft Copilot Injection Flaw Two Microsoft vulnerabilities demand immediate attention from UK small businesses running Windows endpoints and Microsoft 365. CISA has confirmed active ransomware exploitation of the Windows Task Host privilege escalation flaw, four months after its initial disclosure. This vulnerability allows attackers who have gaine...

Clop, ShinyHunters, and SAP: When Supplier Risk Becomes Attack Surface Three distinct threat campaigns broke on 14 August 2026, and each one targets the same vulnerability: supplier and third-party infrastructure. Clop ransomware claimed 89GB of Shell data via managed file transfer platforms, continuing a six-year pattern of targeting MFT tools across supply chains. ShinyHunters exposed 1.6 millio...

Cybersecurity Challenges Facing UK SMEs Today’s episode tackles key cybersecurity challenges facing UK small and medium enterprises. We delve into the exploits by the Russian-aligned group TA488, discuss vulnerabilities such as CVE-2026-42897, and examine the broader impact of cyber incidents beyond primary targets. Learn about the MacSync Stealer threat to macOS and the potential risks associated...

UK SMBs Face Escalating Cyber Threats In today’s episode of Threat Analysis, Mauven MacLeod delves into critical cybersecurity challenges confronting UK small businesses. We address Russian state-sponsored email attacks targeting Microsoft Outlook with a unique ‘half-click’ method, which offers notable resilience against traditional security measures. Understanding the implications of such threats...

Cyber Threats: Helpdesk Attacks and WordPress Risks Mauven MacLeod presents today’s Threat Analysis, focusing on pressing cyber threats faced by UK small and medium businesses. She explores two major issues: vishing attacks exploiting Microsoft Teams and vulnerabilities in WordPress. Vishing attacks target companies through Microsoft Teams, where attackers impersonate IT helpdesk staff and deploy...

Urgent Vulnerabilities for UK Businesses In today’s episode, Mauven MacLeod tackles pressing vulnerabilities affecting UK small and medium businesses. Microsoft’s Defender for Endpoint is under scrutiny due to bugs that leave Linux systems unprotected. From installation issues on hardened RHEL systems to deactivation on restart, these glitches pose significant security risks. Attention is drawn to...

Addressing Mistic Backdoor and FortiBleed Risks In today’s episode of Threat Analysis, Mauven MacLeod explores two significant cyber threats impacting UK small and medium-sized businesses: the Mistic backdoor and the FortiBleed campaign. Both threats exploit vulnerabilities requiring immediate attention. The Mistic backdoor, potentially operated by the notorious access broker Woodgnat, uses sidelo...

UK SMBs Face Ransomware Re-Extortion and Langflow Threats In this episode of Threat Analysis, Mauven MacLeod explores critical cyber threats that UK small and medium-sized businesses (SMBs) must be aware of. The discussion begins with the increasing trend of ransomware re-extortion, where attackers demand additional payments even after receiving a ransom. Proofpoint reports show over a third of vi...

Protecting Against Ransomware and Evolving Cyber Threats In today’s briefing, Mauven MacLeod delves into imperative cybersecurity updates impacting UK businesses. The Qilin ransomware gang is actively exploiting a critical flaw in Palo Alto Networks’ GlobalProtect VPN, posing significant risks even to small enterprises. This episode underscores why businesses of all sizes must prioritise security...

ServiceNow RCE Under Active Exploitation, Plus M365 Passkey Vishing Three critical threats demand immediate attention today. A remote code execution vulnerability in ServiceNow’s AI Platform (CVE-2026-6875) is now actively exploited in the wild, requiring urgent patch verification from direct users and managed service providers alike. Meanwhile, a vishing campaign running since April has been succ...

FortiSandbox Exploit, Windows Zero-Day, and ClickFix Infrastructure at Scale CISA added critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed in-the-wild exploitation. The US federal patching deadline is Sunday, but active exploitation means UK organisations should treat this as immediate priority. A newly published Windows local privil...

Social Engineering, Trojanised Tools, and Supply Chain Attacks This episode examines three contemporary threats exploiting trusted channels. Following the sentencing of two Scattered Spider members for the Transport for London breach, we analyse why social engineering remains devastatingly effective against organisations of all sizes. We then review a Russian campaign distributing trojanised WebEx...

SharePoint Exploitation, AiTM Phishing, and AsyncAPI Supply Chain Attack On 15 July 2026, Mauven MacLeod examines three active threats facing UK organisations. CISA has added three Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities catalogue following confirmed active exploitation targeting on-premises deployments, with particular exposure among professional service...

When MFA Stops Working: Jalisco, OmegaLord, and AI-Built Attack Infrastructure Two active phishing kits, Jalisco and OmegaLord, are defeating multi-factor authentication on Microsoft 365 accounts through adversary-in-the-middle proxying and device code abuse. At the same time, documented research shows a jailbroken AI model built a fully functional command-and-control server in six minutes with mi...

Russian State Exploitation, ShareFile Emergency Shutdown, and DocuSign RMM Abuse This briefing examines three concurrent threats that share a common vulnerability: neglected infrastructure. The NCSC and eight international partners issued a joint advisory on Russian state actors (FSB-linked Static Tundra and Berserk Bear) exploiting poorly configured network edge devices to establish persistent ac...

Preventable Failures: NetScaler Ransomware, Session Theft, and Email Errors This episode examines three current UK cyber security incidents that share a troubling characteristic: all were preventable. Mauven MacLeod analyses the seven-step ransomware chain exploiting unpatched Citrix NetScaler appliances (CVE-2025-5777), documented by Huntress across multiple UK organisations. The briefing covers...