What to look out for today
Keep an eye out for signs that an internet-facing firewall or VPN account has been taken over, and for phishing that references recent incidents (especially healthcare). Reporting today also highlights how ransomware affiliates are speeding up intrusions using automation/AI tooling, reducing the time you have to spot and stop an attack.
- Unusual VPN/firewall logins (new countries, new devices, odd hours).
- Unexpected password reset emails, MFA prompts, or “new device signed in” alerts for Microsoft 365, Google, VPN or admin tools.
- Phishing themed around real organisations/incidents (e.g. medical/lab results, invoices, account verification).
- Staff receiving urgent attachments or links that claim to be shipping/logistics updates or documents to review.
Why this matters to smaller businesses
SMEs often rely on a small number of key systems—remote access (VPN), Microsoft 365/Google, accounting and line-of-business apps. If attackers capture edge device credentials or reuse stolen passwords, they can move quickly to disrupt operations (ransomware) or steal data. Separately, when large suppliers suffer breaches, criminals commonly use the news as cover for convincing follow-on phishing aimed at smaller firms and charities.
Warning signs
- Multiple failed login attempts followed by a successful login to VPN/firewall or cloud admin accounts.
- New or unexpected admin accounts, or privilege changes you didn’t request.
- Users reporting repeated MFA push notifications they didn’t initiate (“MFA fatigue”).
- Sudden email rules/forwarding set up in mailboxes (e.g. invoices diverted).
- Unexpected lockouts, disabled security tools, or new remote management tools appearing.
How attackers may exploit the situation
- Edge device/VPN compromise: attackers target exposed firewalls and VPNs to obtain credentials and then attempt broader compromise.
- Speed and automation: intrusion crews increasingly use automated tooling (including AI-assisted workflows) to move from initial access to data theft and disruption faster than manual response.
- Breach-driven phishing: after a public supplier breach, attackers may send realistic emails/texts to customers or partners to harvest logins, push “updated payment details”, or deliver malware.
- Chat-based phishing: business chat is an increasingly common channel for social engineering; Microsoft has announced new Teams phishing detection coming soon, but it won’t stop everything.
What to do today
- Check your remote access exposure: confirm who can access VPN/firewall portals from the internet and ensure admin access is tightly restricted.
- Review sign-in alerts: look at Microsoft 365/Google/VPN sign-in history for impossible travel, unfamiliar locations, or unusual devices.
- Reset risk: if you see suspicious sign-ins, reset passwords and revoke sessions/tokens for affected accounts, prioritising admins and finance users.
- Reinforce staff reporting: remind staff to report unexpected MFA prompts and suspicious Teams messages, not just email.
- Prepare for disruption: confirm you can restore key systems (file server, M365/SharePoint, finance) and that backups are protected from account takeover.
Ask your IT provider
- Are our firewall/VPN management interfaces exposed to the internet? If yes, what extra controls are in place (MFA, IP allow-listing, admin access restrictions)?
- Do you monitor for unusual VPN and Microsoft 365 sign-ins (new geo/device, admin role changes, mailbox forwarding rules)? How quickly do you alert us?
- Can you confirm our logs are retained and reviewed (VPN/firewall, Microsoft 365, endpoint security) so we can investigate quickly?
- What is our current readiness for ransomware: isolated backups, tested restores, and a plan for operating if systems are down?
- With Teams phishing detection arriving in early November 2026, what changes (if any) will you make to policies, user reporting, and security monitoring?
Patch watch - only one short paragraph, and only if relevant
CISA has flagged an actively exploited vulnerability affecting Arista VeloCloud Orchestrator. If your organisation (or your IT provider) uses VeloCloud, treat this as urgent: confirm ownership, assess exposure, and prioritise remediation. Even if you don’t use it, this is a reminder to inventory and regularly review any internet-facing “edge” management consoles.
One action today
Review VPN/firewall and Microsoft 365 sign-in logs today for unusual locations/devices and immediately reset/revoke sessions for any suspicious accounts (start with admins and finance).
Related Actions On Cyber resource
Actions On Cyber CTA: “SMB Ransomware Readiness & Account Takeover Checklist (VPN + Microsoft 365)”
Sources
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials (The Hacker News)
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions (The Hacker News)
- Quest Diagnostics confirms data breach exposed patient records (BleepingComputer)
- Microsoft Teams to get AI-powered, context-aware phishing detection (BleepingComputer)
- CISA Adds One Known Exploited Vulnerability to Catalog (CISA Cybersecurity Advisories)
- Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.