Today’s look-out: Remote-access and firewall disruption + helpdesk impersonation scams
What to look out for today
Three themes worth acting on today:
- Remote-access disruption risk: attackers are actively exploiting an issue that can crash Cisco ASA/FTD SSL VPN devices, potentially taking remote working and site-to-site access offline.
- Internet-exposed admin portals being targeted: reports of active exploitation against Palo Alto Networks management interfaces that are exposed to the internet.
- Social engineering pressure: incident responders are seeing IT helpdesk impersonation (vishing) and rising ransomware/pre-ransomware activity.
Why this matters to smaller businesses
- Downtime hits hardest: if your firewall/VPN crashes, you may lose remote access, VoIP, shared drives, cloud access paths, or connections between sites—stopping work and delaying customer service.
- SMEs often rely on one provider: if your MSP hosts or manages the firewall/VPN, their response speed determines your outage duration.
- Helpdesk scams bypass “good” tech: a convincing phone call can trick staff into handing over MFA codes, resetting passwords, or installing remote tools—leading to account takeover and ransomware.
Warning signs
- Sudden VPN instability: frequent disconnects, repeated reboots, or remote users unable to connect (especially if it starts without any internal change).
- Unexpected IT calls: callers claiming to be “your IT team/MSP/Microsoft” urging urgent action, password resets, or requesting one-time codes.
- Admin access anomalies: firewall or network admin portals being accessed at unusual times, from unfamiliar locations, or repeated failed logins.
- Ransomware “warm-up” behaviour: new admin accounts, remote tools appearing, or unusual file activity before any ransom note.
How attackers may exploit the situation
- Business disruption: crashing edge devices to force outages, distract IT, or create pressure to accept risky “support” help.
- Abusing exposed management interfaces: targeting internet-accessible admin pages on network devices that were never meant to be public-facing.
- Helpdesk vishing: impersonating IT to persuade staff to approve MFA prompts, share codes, or “verify” login details.
- Credential and key reuse: stolen or exposed cloud/API credentials (e.g. from public code repositories) can enable access to SaaS, backups, or AI/cloud tools—sometimes without triggering obvious alarms.
What to do today
- Confirm your exposure: list what you use for firewall/VPN (Cisco ASA/FTD? Palo Alto?), who manages it (MSP or in-house), and whether any management interface is exposed to the internet.
- Set a “no codes on calls” rule: tell staff never to share MFA codes or approve MFA prompts because of a phone call. Use a call-back procedure to a known number.
- Prepare for an outage: ensure you have a documented fallback for critical work (alternate remote access method, local contact list, offline invoicing/process notes, and how to reach your MSP).
- Check logging/alerts: make sure someone will notice repeated VPN crashes, firewall reboots, or unusual admin logins today (even a simple email/SMS alert helps).
Ask your IT provider
- Are any of our firewall/VPN management interfaces exposed to the internet? If yes, what’s the business reason and what extra controls are in place?
- Do we use Cisco ASA/FTD SSL VPN anywhere, and are we affected by the actively exploited crash issue? What is your mitigation/upgrade plan and timeline?
- Do we have monitoring for device reboots/crashes and repeated remote-access failures, and who is on-call if it happens?
- What is our ransomware readiness status (backup isolation, restore testing, privileged access controls), given the reported increase in cases?
- Do you have a process to detect leaked credentials (especially cloud/API keys) and rotate them quickly if found?
Patch watch - only one short paragraph, and only if relevant
If your business (or MSP) runs Cisco ASA/FTD SSL VPN or has Palo Alto management interfaces, treat today as a prompt to confirm whether you are exposed and whether fixes/mitigations have been applied. This is less about routine patching and more about avoiding sudden remote-access outages and reducing the chance of internet-exposed admin surfaces being targeted.
One action today
Send a same-day note to staff: “IT will never ask for your MFA code or to approve a login over the phone”—and require a call-back to a known internal/MSP number for any urgent ‘helpdesk’ request.
Related Actions On Cyber resource
Actions On Cyber checklist: Helpdesk impersonation (vishing) & MFA push fatigue – staff script and call-back procedure
Sources
- New Cisco firewall zero-day exploited to crash SSL VPN devices (BleepingComputer)
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls (The Hacker News)
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces (The Hacker News)
- IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases (Cisco Talos)
- 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.