What to look out for today
- WordPress supplier incident: stolen connection keys linked to TeamUpdraft services (UpdraftCentral/related services) are being used to plant backdoors on connected WordPress sites.
- Ransomware disruption: CISA is warning about the scale of SafePay ransomware activity, with impacts across many organisations since 2024.
- Remote access reliability: Microsoft says October updates didn’t actually fix an Always On VPN issue—expect potential connectivity problems for remote staff and IT admin access.
Why this matters to smaller businesses
SMEs often rely on a small number of trusted suppliers and “set-and-forget” tooling: managed WordPress plugins, remote admin consoles, and always-on VPNs. When a supplier’s trust is abused, attackers can bypass normal defences and go straight for website control, credential theft, or follow-on scams (like fake invoices). Separately, ransomware remains a major cause of multi-day business disruption, and VPN instability can slow incident response and day-to-day operations.
Warning signs
- WordPress: new admin users you don’t recognise, unexpected plugin/theme changes, unusual scheduled tasks, or your site making outbound connections you can’t explain.
- Customer-facing symptoms: website redirects, new pop-ups/forms, or complaints that your website is asking for unusual logins or payment details.
- Ransomware precursors: sudden MFA prompts, password reset emails you didn’t request, or staff reporting “odd” logins/lockouts.
- VPN: increased helpdesk tickets for dropouts, staff unable to reach file shares/line-of-business apps, or IT tools failing to connect to endpoints.
How attackers may exploit the situation
- Supplier access abuse (WordPress): attackers can use stolen remote-management connection keys to send commands or implant backdoors, then maintain persistence and steal data.
- Trust-in-platform delivery: attackers increasingly use legitimate platforms (collaboration, file-sharing, payment and other services) to deliver links/files that bypass suspicion and some filtering.
- Ransomware playbook: initial access (often via stolen credentials or phishing) followed by lateral movement and disruption to backups and recovery paths before encryption/extortion.
- Operational disruption leverage: VPN instability can mask malicious activity (“it’s just the VPN again”) and can slow containment if admins can’t reliably reach systems.
What to do today
- If you run WordPress: identify whether you use TeamUpdraft services (e.g., UpdraftCentral) and ensure whoever manages your site checks for unexpected admin accounts/changes and reviews any alerts from the vendor.
- Reduce trust in inbound links/files: remind staff to treat “shared documents”, “payment portals”, and “collab invites” with caution—even when they appear to come from well-known platforms.
- Ransomware readiness: confirm you can restore key systems (and your website) from backups that are not easily altered from day-to-day admin accounts.
- Business continuity: if you depend on Always On VPN, plan for short-term workarounds (alternate access method, local procedures, or on-site fallbacks) and communicate what staff should do if VPN fails.
Ask your IT provider
- Do any of our websites use UpdraftCentral/UpdraftPlus-related remote services—and have you checked for signs of unauthorised access or changes?
- What monitoring is in place for our website admin logins and changes (new users, plugin installs, file changes, unusual outbound traffic)?
- Are our backups protected from tampering (separate credentials, immutable/offline copies), and when was the last successful restore test?
- What’s our plan if VPN is unstable—how will you administer endpoints and how will staff access critical apps safely?
- What controls do we have to spot phishing delivered via legitimate platforms (mail filtering, link scanning, staff reporting process)?
Patch watch - only one short paragraph, and only if relevant
Microsoft reports that October updates didn’t actually fix an Always On VPN issue, so treat VPN connectivity problems as an operational risk this week: watch for increased failures, avoid assuming “it’s fixed now”, and ensure your IT support has a documented fallback for remote access and incident response.
One action today
If you run WordPress, ask your webmaster today to check for unexpected admin users and recent changes (plugins/themes/files) and confirm whether UpdraftCentral is used anywhere in your estate.
Related Actions On Cyber resource
Actions On Cyber: Supplier & SaaS Incident Quick Checklist (what to ask, what to verify, and how to reassure staff and customers)
Sources
- Stolen UpdraftCentral keys used to backdoor WordPress sites (BleepingComputer)
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites (The Hacker News)
- Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers (Cisco Talos)
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs (BleepingComputer)
- Microsoft says October updates didn’t actually fix VPN issues (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.