Threat Analysis : Cyber News for Small Business – Détails, épisodes et analyse

Détails du podcast

Informations techniques et générales issues du flux RSS du podcast.

Threat Analysis : Cyber News for Small Business

The Small Business Cyber Security Guy

Business & Entrepreneuriat

Fréquence : 1 épisode/2j. Total Éps: 57

Threat Analysis is the daily cyber security briefing for people who are tired of corporate fog, vendor panic, and security theatre dressed up as strategy.

Hosted by Mauven MacLeod, it cuts through the noise around cyber threats, ransomware, data breaches, regulation, supply chain risk, and the latest bright idea from people who think a dashboard is the same thing as resilience.

Every weekday, Mauven looks at what happened, why it matters, who should be paying attention, and what small and medium sized businesses should do before the mess arrives with a press statement and a very expensive consultant.

This is not fear mongering. It is not a product pitch. It is not another cosy chat about awareness while the back door is hanging off its hinges.

It is sharp, practical threat analysis with a dry edge, a raised eyebrow, and very little patience for nonsense.

You will get clear context, useful actions, and the occasional reminder that cyber security is not magic. It is governance, discipline, evidence, and doing the basics before reality applies a boot to the backside.

Threat Analysis is part of The Small Business Cyber Security Guy network.

Lire plusRéduire

Site

RSS

Apple

Données mises à jour le 22/09/2026

Classements récents

Dernières positions dans les classements Apple Podcasts et Spotify.

Apple Podcasts

Spotify

Aucun classement récent disponible

Liens partagés entre épisodes et podcasts

Liens présents dans les descriptions d'épisodes et autres podcasts les utilisant également.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog
36 partages
https://www.theregister.com/
14 partages
https://unit42.paloaltonetworks.com/
10 partages

https://www.ncsc.gov.uk/
30 partages
https://www.ncsc.gov.uk
12 partages

https://www.microsoft.com/
6 partages
https://www.microsoft.com/security/blog
6 partages
https://www.microsoft.com
2 partages

Qualité et score du flux RSS

Évaluation technique de la qualité et de la structure du flux RSS.

Qualité du flux RSS

À améliorer

Score global : 42%

Historique des publications

Répartition mensuelle des publications d'épisodes au fil des années.

Year

Derniers épisodes publiés

Liste des épisodes récents, avec titres, durées et descriptions.

Evolving Cyber Threats Facing UK Businesses

lundi 21 septembre 2026 • Durée 06:17

Evolving Cyber Threats Facing UK Businesses

Join Mauven MacLeod for today’s Threat Analysis as we explore significant cyber threats impacting UK businesses. We begin with TraderTraitor, a subgroup of the Lazarus Group, which has shifted focus from cryptocurrency firms to IT services providers, highlighting a strategic expansion in their attack vectors. For small businesses, this underscores the importance of cybersecurity, regardless of sector involvement. Next, we examine Head Mare’s exploit of vulnerabilities in TrueConf’s video conferencing servers using PhantomCore malware. This highlights the critical need for robust communication security amidst the rise in remote work. Finally, we cover Microsoft’s recommendation to transition from SMS-based authentication to passkeys, emphasising the importance of strengthening digital identity security. Proactive security practices, including regular audits and comprehensive patch management, are essential for enduring in today’s hostile cyber landscape.

Chapters

Intro Mauven introduces the episode, highlighting the interconnected nature of cyber threats affecting UK businesses.
TraderTraitor’s IT Services Attack Discussion on TraderTraitor’s shift to target IT services, urging small businesses to enhance their cybersecurity measures.
CTA Reminder to follow the show for daily updates and share with others.
Head Mare’s PhantomCore Exploit Examination of Head Mare’s attack on TrueConf, stressing the importance of communication security and patch management.
Microsoft’s Authentication Transition Coverage of Microsoft’s push towards passkey authentication, advising businesses to adopt more secure identity protocols.
Outro Summary of key points and encouragement to stay proactive in cybersecurity.

Links

Lire plusRéduire

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse

vendredi 18 septembre 2026 • Durée 14:15

Third-Party Trust Exploited: Brevo, Clop, and RMM Abuse

On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious code into JavaScript assets that reached over 100,000 customer websites. WordPress administrators had backdoor plugins silently installed while logged in; regular visitors faced ClickFix credential-harvesting overlays. Meanwhile, the Clop threat group continues exploiting CVE-2026-12569 in PTC Windchill with a custom web shell built for rapid data exfiltration, targeting UK manufacturing and engineering supply chains. A third campaign involves Settra ransomware maintaining persistence via MeshAgent, a legitimate remote monitoring tool that endpoint security often trusts by default. All three attacks share one structural weakness: reliance on third-party platforms, scripts, and tools that UK small businesses cannot directly audit or control. This briefing walks through the mechanics of each campaign, explains why supply chain compromise scales so effectively, and sets out the specific questions business owners must ask their web developers, IT providers, and managed service providers today. No patch can protect you from a script you load from someone else’s content delivery network, and no endpoint tool will flag an RMM agent it has been trained to trust. The NCSC has published supply chain guidance repeatedly; these campaigns demonstrate how rarely it is applied in practice.

Chapters

Intro Mauven frames the common vulnerability across today’s campaigns: reliance on third-party platforms that UK small businesses cannot audit, patch, or monitor in real time.
Brevo Supply Chain Attack On 14 September 2026, attackers compromised Brevo’s infrastructure, injecting malicious JavaScript that silently installed WordPress backdoor plugins on admin machines and delivered ClickFix credential-harvesting overlays to visitors across over 100,000 customer sites.
CTA Mauven asks listeners to follow the show and share it with colleagues who need the briefing.
Clop Returns with a Custom Implant The Clop threat group is exploiting CVE-2026-12569 in PTC Windchill with a custom web shell built for rapid credential harvesting, database enumeration, and data exfiltration, targeting UK manufacturing and engineering businesses.
Settra Ransomware and RMM Abuse Settra ransomware maintains persistence by installing MeshAgent, a legitimate remote monitoring tool that endpoint security trusts by default, making unauthorised access harder to detect.

Links

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action

jeudi 17 septembre 2026 • Durée 13:57

Cisco ISE Zero-Day and GhostCode OAuth Phishing Demand Immediate Action

Two critical threats require immediate attention from UK businesses today. Cisco has disclosed an authentication bypass vulnerability in its Identity Services Engine with a maximum CVSS score of 10.0, and exploitation is already confirmed as active. ISE functions as a network gatekeeper for VPN, device compliance, and access control, making this vulnerability a direct path to your network perimeter. Separately, the GhostCode phishing technique weaponises Microsoft’s legitimate OAuth device code flow to bypass multi-factor authentication entirely. The attack arrives via business contact forms, presents victims with authentic Microsoft URLs, and produces valid session tokens that persist even after password resets. Analysis of ransomware activity in Japan reveals that 80 per cent of victims had capital under one billion yen, confirming that small and medium businesses are the majority of targets, not the exception. With Windows 11 24H2 reaching end of support in October 2026, unpatched endpoints remain a consistent entry point in post-breach analysis. This briefing provides specific actions for patching, MFA hardening, conditional access policies, and session revocation.

Chapters

Introduction Mauven introduces two urgent threats: a Cisco vulnerability with active exploitation and a phishing technique that bypasses MFA controls most organisations rely on.
Cisco ISE Authentication Bypass (CVSS 10.0) Analysis of the critical Cisco Identity Services Engine vulnerability with confirmed active exploitation, explaining why network access control systems are high-value targets and providing immediate patching guidance.
Call to Action Encouragement to follow the show and share with business owners and IT providers who need timely threat intelligence.
GhostCode OAuth Device Code Phishing Detailed breakdown of the GhostCode phishing kit that abuses Microsoft’s OAuth 2.0 device authorisation flow to bypass MFA, including detection indicators and specific mitigation steps.
Ransomware Targeting of Smaller Businesses Analysis of Cisco Talos data showing 80 per cent of ransomware victims in Japan were small and medium enterprises, challenging the assumption that smaller size reduces risk.
Windows 11 24H2 End of Support Reminder that Windows 11 24H2 Home and Pro editions reach end of support in October 2026, with guidance on fleet assessment and update planning.

Links

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day

mercredi 16 septembre 2026 • Durée 13:29

ScreenConnect Exploited, OAuth Device Phishing, and Pixel Zero-Day

CISA has confirmed active exploitation of a critical ConnectWise ScreenConnect vulnerability, the remote access tool used by countless UK IT providers to support small business clients. Attackers are targeting managed service providers to gain indirect access to entire client portfolios. Meanwhile, the GhostCode phishing campaign is bypassing traditional defences by abusing Microsoft’s legitimate OAuth device code flow, landing in inboxes through web contact forms and requiring no fake login pages. Finally, Google has patched a zero-day privilege escalation flaw in Pixel devices that was exploited in targeted attacks. This briefing explains why these threats matter to UK SMBs, what the attack patterns look like in practice, and what concrete actions business owners and IT managers should take today. Mauven MacLeod delivers the technical detail and the operational context that turns threat intelligence into defensible decisions.

Chapters

Introduction Mauven introduces two active threats targeting UK small businesses through legitimate infrastructure: a remotely exploited ScreenConnect flaw and an OAuth device phishing technique that bypasses traditional defences.
ScreenConnect: CISA Confirms Active Exploitation CISA has added a critical ConnectWise ScreenConnect vulnerability to its Known Exploited Vulnerabilities catalogue. Attackers are targeting IT providers to gain indirect access to their SMB clients. Business owners are advised to verify their MSP has patched the tool and to understand the supply chain risk.
Call to Action A reminder to follow the show and share the briefing with colleagues who need the information.
GhostCode: OAuth Device Phishing eSentire has documented the GhostCode phishing kit, which abuses Microsoft’s OAuth device code flow to gain persistent access to Microsoft 365 accounts. The campaign impersonates procurement officers, uses web contact forms, and directs victims to legitimate Microsoft URLs, bypassing traditional phishing defences.
Pixel Zero-Day Google’s September 2026 patch for Pixel devices includes a fix for a zero-day privilege escalation vulnerability exploited in targeted attacks. Organisations using Pixel devices should install the update immediately.
Closing Remarks Mauven summarises the three practical actions listeners should take: verify ScreenConnect patch status with IT providers, brief staff on OAuth device code phishing indicators, and review OAuth app consents in Microsoft Entra admin centre.

Links

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack

mardi 15 septembre 2026 • Durée 14:10

Web Skimmers, IoT Botnets, and Search Engine Fraud: Trust Under Attack

Three active cybercriminal campaigns are exploiting trust in routine business systems. GrelosGTM injects payment skimmers into Google Tag Manager containers on compromised e-commerce sites, bypassing traditional file integrity checks and PCI compliance tools. Two IoT malware families, KATARU and Evooo1Bot, are scanning for unpatched edge devices using vulnerabilities dating back to 2007, turning compromised routers and network appliances into proxy infrastructure. Meanwhile, criminals are creating convincing fake versions of legitimate financial portals that surface in organic search results through typosquatting and Punycode manipulation. Each campaign targets a different attack surface, but all exploit the same underlying assumption: that familiar tools, devices, and search results are inherently trustworthy. Mauven MacLeod examines the behavioural incentives that make these attacks effective and outlines practical steps UK businesses can take today to audit their Google Tag Manager containers, verify firmware on internet-facing devices, and reduce social engineering risks through simple URL management practices.

Chapters

Introduction Overview of three active campaigns exploiting trust in marketing tools, network hardware, and search engine results.
GrelosGTM: Payment Skimming Hidden Inside a Marketing Tool Group-IB research on a cybercriminal group injecting malicious scripts into Google Tag Manager containers on Magento e-commerce sites. Practical audit steps for UK businesses.
Call to Action Encouragement to follow the show and share with small business owners.
KATARU and Evooo1Bot: Two IoT Botnets Scanning for Unpatched Devices Two Mirai-derived botnets exploiting weak credentials and decades-old vulnerabilities in internet-facing edge devices. Includes FortiGate SSL-VPN intrusion campaign detail and firmware audit checklist.
Search Engine Fraud: Fake Crypto Gift Card Checkouts Criminals creating convincing fake versions of legitimate portals that appear in organic search results through typosquatting and Punycode manipulation. Simple URL management mitigations.
Closing Connecting thread across all three campaigns and practical takeaway: audit the things you have stopped looking at.

Links

https://www.group-ib.com/resources/research-hub/grelosgtm/

Revolut Social Engineering Breach and GitLab Path Traversal Exploit

lundi 14 septembre 2026 • Durée 13:35

Revolut Social Engineering Breach and GitLab Path Traversal Exploit

A major fintech data breach demonstrates how impersonation attacks bypass technical defences entirely, whilst a maximum-severity GitLab vulnerability enters active exploitation. This episode examines Revolut’s disclosure of customer financial and passport data released following a fraudulent government agency impersonation, highlighting the procedural failures that enable social engineering at scale. We cover CISA’s addition of a GitLab path traversal flaw to the Known Exploited Vulnerabilities catalogue, the supply chain implications for UK SMBs, and practical verification procedures that prevent data disclosure to unauthorised parties. Operational updates include Microsoft’s September patches breaking Remote Desktop Services on Windows Server, and the UK government’s passkey rollout across 23 million GOV.UK accounts. The episode focuses on verification protocols, out-of-band confirmation procedures, and supply chain questioning as practical defences against non-technical attack vectors that compromise organisations with significant security resources.

Chapters

Introduction Mauven introduces the episode focus on a fintech breach achieved through convincing impersonation rather than technical exploitation, setting up the central theme of procedural failures in data handling.
Revolut Breach via Government Impersonation Analysis of Revolut’s data breach following a fraudulent government agency request, examining the social engineering mechanism, customer impact, verification procedure failures, and practical implementation of out-of-band confirmation protocols for UK SMBs handling data disclosure requests.
CTA Call to action encouraging listeners to follow the show and share with colleagues handling data requests and code repositories.
GitLab Path Traversal Flaw, Actively Exploited, Maximum Severity Coverage of CISA’s addition of a GitLab path traversal vulnerability to the Known Exploited Vulnerabilities catalogue, explanation of path traversal attack mechanics, supply chain exposure risks through developer and MSP relationships, and immediate patching requirements.
September Windows Updates and RDS Microsoft’s September 2026 security updates breaking Remote Desktop Services functionality on Windows Server, the patching versus functionality trade-off, and recommendations for planned deployment with awareness of the known issue.
UK Government Passkey Rollout UK government’s passkey implementation across 23 million GOV.UK accounts, the stated rationale of reducing phishing exposure and SMS verification costs, and implications for SMB authentication strategy beyond SMS-based MFA.

Links

Russian State Actors Target Business Travellers via Hotel Wi-Fi

vendredi 11 septembre 2026 • Durée 16:57

Russian State Actors Target Business Travellers via Hotel Wi-Fi

This episode examines three active threat campaigns with direct SMB relevance. Russian state group APT29 (Midnight Blizzard) is conducting large-scale credential harvesting through compromised hotel and conference Wi-Fi networks across the UK and Europe, specifically targeting business travellers. The operation exploits captive portal authentication flows to harvest Microsoft 365 credentials through spoofed login pages and device code phishing that bypasses MFA. A second campaign demonstrates AI-orchestrated exploitation of PaperCut print management software, progressing from vulnerability research to remote code execution in under four hours across 440+ installations. The episode also covers a maximum-severity GitLab path traversal vulnerability and recent Conti ransomware sentencing. Analysis focuses on the systematic targeting of authentication layers, the operational risk to SMBs from compromised cloud tenancies, and the acceleration of exploit development through AI automation. Practical guidance addresses device code flow controls, conditional access policies, VPN discipline for travelling staff, and the limitations of MFA as a single defensive layer.

Chapters

Introduction: Active Campaigns Targeting Business Travellers Overview of Russian state-sponsored credential harvesting via UK hotel Wi-Fi networks and AI-orchestrated PaperCut exploitation campaign. Episode positions APT29 activity as immediate SMB threat rather than purely government-sector concern.
CaptiveCrunch: APT29 Hotel Wi-Fi Credential Harvesting Detailed analysis of Midnight Blizzard (APT29) campaign exploiting captive portal networks at hotels and conferences. Explains device code phishing technique that bypasses MFA, SMB impact from compromised Microsoft 365 tenancies, and four immediate mitigation actions including device code flow controls and conditional access policies.
Call to Action Listener engagement request to follow show and share briefing given active campaign status.
AI-Orchestrated PaperCut Exploitation Analysis of CVE-2026-81578 and CVE-2026-82078 exploitation campaign against PaperCut print management software. Details AI agent automation achieving remote code execution in under four hours across 440+ targets. Provides specific guidance on patch verification, internet exposure assessment, and compromise indicators.
GitLab Vulnerability and Conti Sentencing Brief coverage of CVE-2026-85706 maximum-severity GitLab path traversal vulnerability requiring immediate patching. Notes Ukrainian national receiving four-year sentence for Conti ransomware development, with analysis positioning outcome as illustrating enforcement limitations rather than meaningful deterrent.

Links

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs

jeudi 10 septembre 2026 • Durée 14:12

WatchGuard Ransomware Exploitation and Chrome Zero-Day Chain Target UK SMBs

Two active exploitation campaigns are affecting UK small businesses today. Ransomware operators are exploiting a critical WatchGuard Firebox vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalogue in December 2025, yet remains unpatched in many deployments nine months later. The flaw allows remote, unauthenticated code execution on internet-facing devices. Separately, four China-aligned threat actors have adopted an identical Chrome and Windows zero-day exploit chain within days of each other, enabling full system compromise through a single malicious webpage visit. The BlueMoon exploit kit combines CVE-2026-85046 in Chrome’s V8 engine with CVE-2026-85880 in the Windows kernel. Patches are available for both campaigns. Additionally, Cisco Secure Firewall Management Center is under active exploitation via two vulnerabilities that grant administrative control, with possible connections to the Qilin ransomware group. Today’s briefing provides specific remediation steps for each threat and examines why a nine-month-old vulnerability continues to find victims, highlighting fundamental patch management failures across the UK SMB sector. Mauven frames the discussion around visibility, accountability, and the compression of exploitation windows in modern threat environments.

Chapters

Introduction Mauven opens the tenth of September 2026 briefing with two active exploitation events affecting UK small businesses: a nine-month-old WatchGuard vulnerability now used by ransomware operators, and a browser-based zero-day chain adopted by four state-aligned actors within days.
WatchGuard Firebox Ransomware Exploitation CISA confirms ransomware gangs are actively exploiting a critical remote code execution flaw in WatchGuard Firebox appliances. The vulnerability was added to the KEV catalogue in December 2025, yet remains unpatched in many UK SMB deployments. Ransomware operators use automated scanning to find vulnerable devices. Mauven emphasises the need to verify firmware versions immediately and obtain written confirmation from managed service providers.
Call to Action Mauven encourages listeners to follow the show and share it with colleagues who need daily threat intelligence.
BlueMoon Chrome Zero-Day Exploit Chain Proofpoint and Volexity report on the BlueMoon exploit kit, which chains CVE-2026-85046 in Chrome’s V8 engine with CVE-2026-85880 in the Windows kernel. Four China-aligned threat actors adopted identical exploitation within days, suggesting coordinated or brokered tooling. The attack requires only visiting a compromised webpage and achieves full system compromise. Patches are available from Google and Microsoft’s September 2026 Patch Tuesday.

Links

UK Cybersecurity: Patch Tuesday and New Threats

mercredi 9 septembre 2026 • Durée 05:47

UK Cybersecurity: Patch Tuesday and New Threats

In today’s briefing, Mauven examines key cybersecurity threats relevant to UK businesses. Microsoft’s record Patch Tuesday reveals 973 vulnerabilities, with 113 rated as critical, highlighting the urgency for timely updates. Two zero-day vulnerabilities pose active risks. Small and medium UK businesses often underestimate their appeal to cybercriminals, leaving systems vulnerable. Additionally, Plex Media Servers have over 36,000 exposed units due to security lapses, stressing the need for rigorous patch compliance. The emergence of the BlueMoon exploit chain underlines the danger of using outdated software, as state actors weaponise newly discovered vulnerabilities in platforms like Chrome and Windows. Maintaining up-to-date systems is imperative to prevent costly breaches and attacks. The episode concludes with a reminder that procrastination with updates can be perilous, urging businesses to prioritize security.

Chapters

Intro Introduction to today’s cybersecurity briefing, highlighting the importance of system updates.
Microsoft’s Record Patch Tuesday Analysis of Microsoft’s 973 vulnerabilities, including 113 critical ones and two active zero-day threats, stressing the importance of updates.
CTA Encouragement to follow the podcast for regular updates and share with others.
Plex Media Servers Threat Discussion on the vulnerabilities in over 36,000 exposed Plex Media Servers and the importance of patch compliance.
BlueMoon Exploit Chain Insight into the BlueMoon exploit chain and how outdated systems are exploited by state actors, emphasising the need for current systems.
Outro Final thoughts on the critical nature of timely system updates for business survival.

Links

Lire plusRéduire

Cyber Threats Every UK SME Must Address Today

mardi 8 septembre 2026 • Durée 05:55

Cyber Threats Every UK SME Must Address Today

In this episode of Threat Analysis, hosted by Mauven, we delve into pressing cybersecurity threats facing UK small and medium-sized businesses (SMEs). We begin with the StyleSmuggler zero-day vulnerability targeting Magento and Adobe Commerce. Identified as CVE-2025-54236, this flaw allows unauthorised remote code execution, which underscores the importance of immediate patching. Despite Adobe’s emergency patch, many SMEs remain vulnerable due to a lack of awareness or resources.

We also explore the BigBear 2.0 phishing campaign, which successfully obtained credentials from over five thousand Microsoft 365 accounts globally. This highlights the increasing adoption of phishing-as-a-service models, making it vital for businesses to implement multifactor authentication and foster a culture of vigilance.

Mauven emphasises the need for rapid patch management and strong phishing defenses, encouraging businesses to prioritise vulnerabilities based on their potential impact. Through proactive measures and informed strategies, UK SMEs can safeguard against emerging cyber threats.

Chapters

Intro Introduction to today’s cybersecurity threats for UK SMEs.
StyleSmuggler Zero-Day in Magento Explanation of the StyleSmuggler vulnerability and the need for urgent patching.
CTA Encouragement to follow and share the podcast.
BigBear Phishing Campaign Targets Microsoft 365 Details of the BigBear phishing campaign and the importance of multifactor authentication.
Implications for UK SMBs Discussion on the necessity of strong cybersecurity measures for UK SMEs.
Outro Conclusion emphasising proactive defense and awareness.

Links

Lire plusRéduire

Podcasts Similaires Basées sur le Contenu

Découvrez des podcasts liées à Threat Analysis : Cyber News for Small Business. Explorez des podcasts avec des thèmes, sujets, et formats similaires. Ces similarités sont calculées grâce à des données tangibles, pas d'extrapolations !