Cyber Brief: JFrog Backdoors, MikroTik Flaws, Insider Threat Updates and Android Banking Malware

Today's brief highlights the importance of timely patching, clear ownership of security responsibilities, and understanding how attackers combine multiple techniques to achieve their objectives. From supply chain tools used in software development to network infrastructure, mobile devices and insider risk management, these stories reflect the breadth of operational security considerations UK organisations face daily. Each story offers a practical prompt to review controls, update systems or clarify accountability across technical and governance functions.

Attackers chain JFrog Artifactory flaws to plant backdoors in software supply chains

Wiz reports that attackers have successfully chained two vulnerabilities in JFrog Artifactory, a widely used repository manager in software build pipelines, to gain administrator control of self-hosted servers and install backdoors. The attacks occurred between 15 August and 8 September 2026, targeting organisations that had not applied patches JFrog released earlier in the year. Artifactory is a critical component in many development environments, acting as the central repository from which build systems pull dependencies and artefacts. By compromising Artifactory, attackers can inject malicious code into software builds, potentially affecting every application that relies on those repositories.

For UK businesses using JFrog Artifactory in their development pipelines, this is a direct supply chain risk. If an attacker gains administrator access to your Artifactory instance, they can modify artefacts, inject backdoors into builds, and compromise downstream applications without developers necessarily noticing. This type of attack can have cascading effects across your entire software estate, particularly in organisations with continuous integration and deployment workflows. The fact that these vulnerabilities were exploited in the wild after patches were available underscores the operational challenge many organisations face in maintaining visibility and timely patching across development tooling, which may not always receive the same scrutiny as production infrastructure.

Why it matters

For UK businesses running self-hosted JFrog Artifactory, this is a prompt to verify that all instances are patched to the latest version and to review access controls, authentication mechanisms and logging for any signs of unauthorised administrative activity. Consider whether your development infrastructure receives the same patch management discipline as production systems, and ensure there is clear ownership for monitoring and responding to security advisories affecting build and deployment tools.

Source: The Hacker News

CISA adds two MikroTik RouterOS vulnerabilities to Known Exploited Vulnerabilities catalogue

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. The flaws, CVE-2026-67277 and CVE-2026-86060, involve missing authentication for critical functions and improper neutralisation of argument delimiters in commands. MikroTik routers are widely deployed in enterprise networks, internet service providers, and managed service environments globally, including across the UK. These vulnerabilities allow attackers to execute commands or gain unauthorised access to network infrastructure, potentially enabling lateral movement, traffic interception or persistent access to corporate networks.

While CISA's Known Exploited Vulnerabilities catalogue is a US federal requirement, it serves as a valuable reference for UK organisations because it reflects vulnerabilities that are being actively exploited in the wild. MikroTik devices are common in UK business networks, particularly in smaller enterprises, branch offices and managed service provider environments. If these routers are exposed to the internet or accessible from compromised internal networks, they represent a significant risk. Attackers who exploit these flaws can gain control of network infrastructure, intercept traffic, modify routing, or use the compromised devices as a foothold for further attacks. The operational impact includes potential loss of network visibility, unauthorised access to internal systems, and difficulty in detecting or removing persistent attacker presence.

Why it matters

For UK organisations using MikroTik RouterOS devices, this is a clear signal to review your network infrastructure inventory, verify that all MikroTik routers are running the latest firmware, and ensure that management interfaces are not exposed to the internet without strong authentication and access controls. Consider whether your network team has a process for tracking and responding to vulnerabilities in network infrastructure, not just endpoints and servers.

Source: CISA

CISA updates insider threat guidance with new advice on remote work, AI and risk detection

CISA has published an updated version of its insider threat mitigation guide, incorporating new advice on managing insider risk in remote and hybrid work environments, understanding the implications of AI tools in the workplace, and improving detection of insider threat indicators. Infosecurity Magazine reports that the updated guidance reflects the operational reality that many organisations now face, where employees work from multiple locations, use personal devices, and increasingly rely on AI-powered tools that may introduce new data handling and exfiltration risks. The guide emphasises the importance of clear policies, user behaviour monitoring, access controls, and creating a culture where employees understand the risks and feel able to report concerns without fear of disproportionate consequences.

For UK businesses, insider threat remains one of the most difficult risks to manage because it involves trusted individuals with legitimate access to systems and data. The shift to remote and hybrid work has expanded the attack surface, making it harder to monitor user behaviour, detect anomalies, or enforce physical security controls. The increasing use of AI tools, including large language models and automated data processing platforms, introduces new pathways for accidental or deliberate data leakage. Employees may use AI tools to process sensitive information without understanding the data handling implications, or malicious insiders may exploit these tools to exfiltrate data in ways that are harder to detect. The updated CISA guidance provides a structured framework for organisations to review their insider threat programmes, clarify accountability, and ensure that technical controls, policies and cultural factors are all working together.

Why it matters

For many UK organisations, this is a useful prompt to review whether your insider threat programme adequately addresses remote work, the use of AI tools, and the detection of unusual user behaviour. Consider whether your policies clearly explain acceptable use of AI platforms, whether your monitoring tools can detect data exfiltration through cloud services, and whether there is clear ownership for investigating and responding to insider threat indicators across HR, IT and security teams.

Source: Infosecurity Magazine

MantaxOtax Android malware combines ransomware with extensive spyware capabilities

Infosecurity Magazine reports that a new Android malware strain called MantaxOtax has been identified, combining ransomware functionality with extensive spyware capabilities. The malware encrypts files on infected devices while simultaneously exfiltrating sensitive data including contacts, messages, call logs, location information and credentials. Dark Reading adds that the malware is part of a broader campaign targeting users in Indonesia, where threat actors are exploiting Android Work Profile features to deliver the Gigabud Trojan and other malicious payloads. The campaign demonstrates how attackers are increasingly combining multiple attack techniques within a single malware family, maximising the potential impact and monetisation opportunities from each infection.

While this specific campaign is currently focused on Indonesia, the techniques and malware families involved are relevant to UK organisations, particularly those with mobile workforces, bring-your-own-device (BYOD) policies, or employees who travel internationally. Android malware that combines ransomware and spyware represents a dual threat: not only can it disrupt access to data and devices, but it can also exfiltrate sensitive corporate information, credentials and communications before the victim is even aware of the infection. For organisations with BYOD programmes or employees using personal devices to access corporate email, collaboration tools or cloud services, this type of malware can provide attackers with a pathway into corporate systems. The use of Android Work Profile features to deliver malware is particularly concerning because these features are designed to separate personal and work data on the same device, and users may not expect malicious activity within the work profile environment.

Why it matters

For UK businesses with mobile device management policies, BYOD programmes or employees accessing corporate data from personal Android devices, this is a reminder to review whether your mobile security controls include malware detection, app vetting, and the ability to remotely wipe or isolate compromised devices. Consider whether your acceptable use policies clearly explain the risks of installing apps from untrusted sources, and ensure there is a clear process for employees to report suspicious behaviour on their devices.

Source: Infosecurity Magazine

Today's Key Actions

• Review your JFrog Artifactory instances to confirm they are running the latest patched version, and audit administrator access logs for any signs of unauthorised activity or configuration changes.
• Check your network infrastructure inventory for MikroTik RouterOS devices, verify they are running current firmware, and ensure management interfaces are not exposed to the internet without strong authentication.
• Revisit your insider threat programme to ensure it addresses remote work, AI tool usage, and data exfiltration risks, with clear policies and monitoring capabilities that reflect how your organisation actually operates today.
• Confirm that your mobile device management and BYOD policies include malware detection, app vetting and remote wipe capabilities, and that employees understand the risks of installing apps from untrusted sources on devices used to access corporate data.
• Ensure there is clear ownership across IT, security and development teams for monitoring security advisories, prioritising patches, and responding to vulnerabilities in development tools, network infrastructure and mobile platforms.

Secarma Insight

Effective security comes from understanding that risks span the entire technology estate, from development pipelines and network infrastructure to mobile devices and the people who use them. The most resilient organisations are those that have already established clear ownership, disciplined patch management, and the ability to detect and respond to unusual activity before it becomes a crisis. Today's stories reinforce that good security is not about reacting to every headline, but about maintaining the habits, visibility and accountability that allow you to respond proportionately when issues arise. By ensuring that development tools, network devices, insider threat programmes and mobile security all receive appropriate attention, UK businesses can build confidence that they are managing risk across the full operational landscape.