What to look out for today
- Ransomware groups are actively breaking in using stolen/guessed passwords, phishing, and security-tool weaknesses (SafePay activity highlighted by CISA).
- Ongoing real-world exploitation against VPN/remote access security where attackers can bypass MFA and establish unauthorised connections (reported as used by ransomware groups).
- SaaS/supplier breach ripple effects: a developer platform (Zeabur) is shutting down after a second breach, with large volumes of environment variables exposed—this is a reminder that third-party secrets can leak and trigger follow-on compromise.
- “ClickFix” style social engineering where users are tricked into running steps that infect their own device (ROMULUS/LegionLoader delivery reported).
- Certificate trust risk: compromise of multiple certificate authority (CA) keys (eMudhra intermediates) can increase the chance of convincing fake websites/certificates being used in scams until ecosystem changes bed in.
Why this matters to smaller businesses
Most smaller organisations don’t get hit by “advanced hacking” first—they get hit when someone gets a foothold via remote access, a phished login, or reused passwords, then ransomware follows. Supplier incidents can also create urgent, confusing situations (service shutdowns, sudden credential resets, unexpected “security update” emails) that criminals exploit with convincing phishing.
Warning signs
- Unexpected MFA prompts (push notifications you didn’t initiate) or users reporting “MFA fatigue”.
- New or unusual logins to Microsoft 365/Google/remote access/VPN—especially outside normal hours or from unusual locations.
- Password reset emails or “your VPN account was locked” messages staff weren’t expecting.
- Emails/DMs about supplier incidents urging urgent actions: “reconnect your account”, “re-enter API key”, “download this fix”, “run these steps”.
- Browser certificate warnings disappearing unexpectedly or staff reporting a site “looks the same but feels odd” during login/payment steps.
- Security tools disabled, new admin accounts, or new remote tools appearing without an approved change.
How attackers may exploit the situation
- Credential-based entry: stolen passwords (from past breaches) or guessed passwords used to access email, VPN, or admin portals.
- MFA bypass on edge services: where remote access/security products are misconfigured or behind on security updates, attackers may create unauthorised connections that look “legitimate”.
- Supplier breach follow-on: exposed environment variables and secrets (API keys, tokens, database credentials) can be reused to access your cloud apps, CI/CD, or data stores if you used that supplier or hosted secrets there.
- ClickFix lures: fake landing pages and “security check” prompts that persuade staff to run steps locally—turning a normal web visit into a malware infection.
- More convincing phishing sites in the wake of CA key compromise news: criminals try to make fake login pages look more believable and “trusted”.
What to do today
- Confirm your remote access is under control: list who has VPN/remote admin access, remove leavers/unused accounts, and ensure MFA is enforced for all remote access.
- Run a quick admin account check: verify no new global/admin accounts were created unexpectedly (Microsoft 365, Google Workspace, firewall/VPN portals, finance systems).
- Staff message (2 minutes): remind people not to follow “run these steps to verify you’re human / fix your browser / security check” instructions, and to report unexpected MFA prompts immediately.
- Supplier sanity check: if you use developer platforms/hosting platforms where secrets may live, confirm where environment variables and keys are stored and who can access them.
- Backups reality check: ensure you have at least one backup that is protected from normal user login access (to reduce ransomware impact).
Ask your IT provider
- Can you confirm our VPN/remote access and security gateways are monitored, and that suspicious logins trigger an alert?
- Do we have conditional access (or equivalent) to block risky sign-ins and enforce MFA for admins and remote access?
- What’s our process to detect new admin accounts or privilege changes within 24 hours?
- If one of our suppliers suffers a breach, how quickly can we rotate keys/tokens and identify where they are used?
- What’s our tested plan for ransomware recovery (restore times, priority systems, and who does what in the first hour)?
Patch watch - only one short paragraph, and only if relevant
Ransomware groups are reported exploiting a previously patched authentication-bypass affecting some Palo Alto Networks PAN-OS/Prisma Access deployments. If your business (or your IT provider) uses these services for VPN/remote access, treat it as urgent to confirm you’re on the fixed versions and that logs are reviewed for unusual VPN connections since the spring/summer.
One action today
Send a same-day staff note: “If a website tells you to run steps/commands to ‘verify’ or ‘fix’ something, stop and report it” and remind everyone to report unexpected MFA prompts immediately.
Related Actions On Cyber resource
Actions On Cyber: Ransomware readiness checklist (backup, admin controls, MFA, and first-hour response)
Sources
- #StopRansomware: SafePay Ransomware (CISA Cybersecurity Advisories)
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA (The Hacker News)
- Zeabur shutting down after second security breach in two months (BleepingComputer)
- Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (The Hacker News)
- Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.