What to look out for today
Today’s risk picture is dominated by supplier and platform incidents that can quickly spill into SMEs via stolen credentials, exposed API keys, or MSP/backup tooling. Be on the lookout for:
- MSP / backup supply-chain concerns involving ConnectWise Cloud Backup (as reported by Microsoft).
- Platform secrets exposure risk: Railway reports anomalous activity affecting some customer environment variables (i.e. “secrets”).
- Hosted server compromise: a Japanese VPS provider (Onamae Desktop Cloud) reports malware installed on a large number of customer servers.
- Software supply chain compromise: LiteLLM reports a malicious package release after its pipeline was compromised.
- More convincing web scams and “ClickFix” style lures: Chrome is adding scam protections and warnings when users copy suspicious commands.
Why this matters to smaller businesses
SMEs often depend on third parties for backup, hosting, websites, and business apps. When a supplier is compromised, attackers commonly pivot to customers by:
- Stealing passwords, API keys, and app “secrets” that enable access without triggering obvious alerts.
- Sending highly believable phishing that references the supplier incident (“reset your credentials”, “reconnect your backup”, “verify your account”).
- Disrupting operations (website downtime, backups failing, remote tools abused), increasing pressure to make rushed decisions.
Warning signs
- Unexpected password reset emails, MFA prompts, or “new device signed in” alerts for SaaS/admin accounts.
- Backup jobs suddenly failing, agents going offline, or unusual alerts from your backup/monitoring provider.
- New or unknown API keys, tokens, or “service accounts” appearing in cloud consoles, CI/CD, or integration settings.
- Staff reporting websites asking them to copy/paste commands to “fix” access (a common ClickFix pattern).
- Unplanned changes to DNS, hosting control panels, or server configurations; unexplained outbound traffic from servers.
How attackers may exploit the situation
- Follow-on phishing timed to headlines: attackers impersonate ConnectWise/hosting/PaaS support to capture credentials or MFA codes.
- Token/secret replay: if environment variables or release pipeline credentials are exposed, attackers can access systems without needing user passwords.
- Backup and recovery sabotage: compromise of backup tooling can be used to disable backups or increase ransomware impact.
- Malware on hosted servers: compromised VPS instances can be used to steal data, host phishing pages, or serve as a jump point into business networks.
What to do today
- Re-check who has admin access to backup platforms, hosting panels, domain/DNS accounts, and CI/CD.
- Rotate secrets where feasible: prioritise API keys, service account credentials, and integration tokens for critical systems (finance, payroll, email, backups).
- Send a quick staff note: don’t act on “supplier security alerts” from email alone—verify via your usual support portal or known contact details.
- Confirm you have at least one offline/immutable backup and that you can restore a key file set.
- Review web and server monitoring: look for new admin users, unexpected plugins, scheduled tasks, or unfamiliar processes.
Ask your IT provider
- Are we affected by the ConnectWise Cloud Backup incident in any way (directly or via an MSP toolchain)? What checks have you done?
- Do we store any customer/production secrets in platforms like Railway (or similar), and have we rotated them?
- Which systems have privileged access via API keys/service accounts, and how quickly can we rotate them safely?
- Can you show evidence that backups are running and restorable (a test restore in the last 30 days)?
- What additional monitoring is in place for unusual admin activity across email, backups, hosting, and endpoint security?
Patch watch - only one short paragraph, and only if relevant
If you self-host developer tooling, treat high-severity GitLab security updates as a priority because compromise of source code and CI/CD often leads to stolen secrets and wider business disruption. Ask your IT provider to confirm status and whether any unusual access occurred before the update window.
One action today
Rotate (or at minimum audit) admin credentials and API keys for your backup platform, hosting/DNS accounts, and key SaaS integrations today—and document who changed what.
Related Actions On Cyber resource
Actions On Cyber: Supplier Incident & SaaS Compromise Checklist (verify comms, rotate secrets, review admin access, and test restores)
Sources
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (The Hacker News)
- Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation (The Hacker News)
- Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected (BleepingComputer)
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release (The Hacker News)
- Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks (BleepingComputer)
- GitLab warns of new max severity code execution vulnerability (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.