Cyber Brief: ConnectWise, BeyondTrust, Ransomware & npm Supply Chain

This week's most significant developments share a common thread: attackers are increasingly targeting the tools and services that organisations rely on to manage, protect and recover their systems. From a managed service platform suspending its own cloud services following a compromise, to a Chinese espionage group actively exploiting a remote support vulnerability, to ransomware groups escalating their tactics against employees, the picture that emerges is one where the supporting infrastructure of business operations is itself under sustained pressure. UK organisations — particularly those using managed service providers, remote access tools or open-source development dependencies — have good reason to review how these layers of their environment are governed and monitored.

ConnectWise Suspends Cloud Services After Microsoft 365 Tenant Compromise

ConnectWise, a widely used managed service provider (MSP) platform, suspended seven of its cloud-based application identities over the weekend after discovering that unknown threat actors had obtained unauthorised access and used them to compromise Microsoft 365 tenants. The Hacker News reports that the disabled identities included ConnectWise Cloud Backup, along with several security and management services. Security firm Huntress, which first raised the alarm, alleged that the compromised application identities were being used to facilitate Microsoft 365 account takeovers. ConnectWise confirmed it had taken the services offline as a precautionary measure while its investigation continues.

ConnectWise is used extensively by managed service providers across the UK to deliver remote monitoring, backup and security services to their own clients. When a platform at this level is compromised, the downstream risk extends well beyond ConnectWise itself — every MSP using the affected services, and every business those MSPs support, could potentially be affected. The use of application identities rather than direct credential theft is a notable technique: it allows attackers to operate within trusted service boundaries, making detection harder and the scope of access potentially very broad. Microsoft 365 account takeovers can enable access to email, files, Teams communications and a wide range of connected services.

Why it matters

For UK businesses that rely on a managed service provider, this is a prompt to ask your MSP directly whether they use ConnectWise and whether any of their services were affected. More broadly, it is worth reviewing what third-party application identities have access to your Microsoft 365 environment and ensuring that conditional access policies and audit logging are in place to detect unusual activity from connected applications.

Source: The Hacker News

Chinese Espionage Group Actively Exploiting Critical BeyondTrust Vulnerability

A suspected Chinese state-aligned threat group tracked as Armory Castle — also known as UNC5221 — has been observed actively exploiting a newly disclosed critical authentication bypass vulnerability in BeyondTrust Remote Support, according to reporting by Infosecurity Magazine citing Google threat intelligence. The vulnerability, CVE-2026-102764, affects BeyondTrust Remote Support versions 26.2.3 and earlier, and has been added to CISA's Known Exploited Vulnerabilities catalogue. Researchers note that the first known attack by Armory Castle occurred approximately seven weeks before the vulnerability was publicly disclosed, suggesting the group had prior knowledge of the flaw. The same group has previously targeted Ivanti and Citrix customers.

BeyondTrust Remote Support — formerly known as Bomgar — is used by IT and security teams across many UK organisations to provide privileged remote access to systems and users. An authentication bypass in a tool of this nature is particularly serious because it sits at the heart of privileged access management: a successful exploit can allow attackers to gain initial access, establish persistence, escalate privileges and move laterally across an environment without triggering standard authentication controls. The pattern of targeting edge devices and remote access tools — seen here with BeyondTrust, and previously with Ivanti and Citrix — reflects a deliberate and consistent strategy by sophisticated threat actors to compromise the tools that defend and manage networks.

Why it matters

For UK organisations running BeyondTrust Remote Support, patching should be treated as a priority: versions 24.3.1 and later have patches available, while older versions require an upgrade before patching can be applied. Organisations should also review recent access logs for unusual activity, particularly any sessions that did not follow expected authentication patterns. This is also a timely reminder to audit which remote access and privileged access tools are exposed to the internet and whether their access is appropriately restricted.

Source: Infosecurity Magazine

Ransomware Groups Escalate to Threats of Physical Violence Against Employees

A new report highlighted by Infosecurity Magazine warns that ransomware groups are increasingly using threats of physical violence against employees as a tactic to pressure organisations into paying ransoms. The trend represents a significant escalation in extortion methods: rather than limiting pressure to data exposure or operational disruption, attackers are now directly threatening the personal safety of staff members, including executives and their families. The report notes that these threats are designed to create a sense of personal urgency that bypasses the organisation's normal incident response process and forces faster payment decisions.

This development has meaningful implications for how UK organisations prepare for and respond to ransomware incidents. Incident response plans have traditionally focused on technical recovery, business continuity and communications — but the introduction of personal safety threats creates a new dimension that involves HR, legal, physical security and employee welfare. Staff who receive direct threats may be frightened and may act outside of established processes, potentially making decisions that complicate the organisation's response. There is also a safeguarding dimension: organisations have a duty of care to employees, and that duty does not pause during a cyber incident.

Why it matters

For UK organisations, this is a prompt to review whether your incident response plan addresses the human and welfare dimensions of a ransomware attack, not just the technical ones. Consider whether staff know who to contact if they receive a personal threat, and whether your plan includes guidance for HR, physical security and employee communications. Engaging with law enforcement — including the National Crime Agency — at an early stage of any ransomware incident remains strongly advisable.

Source: Infosecurity Magazine

Malicious npm Package Discovered Hiding Shellcode Loader in Supply Chain Attack

Cybersecurity researchers have identified a malicious npm package named "imgdecode" as part of a broader software supply chain attack campaign dubbed MALFEX, according to The Hacker News. The package was uploaded to the npm registry on 30 September 2026 and had been downloaded nearly 1,000 times at the time of reporting. The package conceals a shellcode loader within a Windows native addon, meaning the malicious payload is not immediately visible through standard code review. The account used to publish the package — "malfexteste8" — appears to have been created specifically for this campaign, and the package remained available on npm at the time of publication.

The npm ecosystem is one of the most widely used package registries in the world, and it is a common dependency source for development teams across UK organisations of all sizes. Supply chain attacks via malicious packages are an established and growing technique: attackers exploit the trust that developers place in open-source registries to introduce malicious code into software builds, CI/CD pipelines or developer workstations. The use of a Windows native addon to conceal shellcode is a technically deliberate choice that makes the payload harder to detect through automated scanning tools that focus on JavaScript-level analysis. With nearly 1,000 downloads in under three weeks, the potential exposure is meaningful.

Why it matters

For UK development teams and organisations with software engineering functions, this is a prompt to review your dependency management practices. Consider whether your teams are using tools that scan for known malicious packages, whether your CI/CD pipeline enforces integrity checks on third-party dependencies, and whether developers have guidance on evaluating the provenance and legitimacy of packages before use. Locking dependency versions and using a private package registry with vetted packages can also reduce exposure to this type of attack.

Source: The Hacker News

Today's Key Actions

• If your organisation uses a managed service provider, contact them to confirm whether they use ConnectWise and whether any of their services were affected by this weekend's incident. Review what third-party application identities have access to your Microsoft 365 environment and check audit logs for unusual activity from connected applications.
• If BeyondTrust Remote Support is in use in your environment, check your current version and apply available patches immediately. Versions 24.3.1 and later can be patched directly; older versions require an upgrade first. Review recent privileged access session logs for any anomalous authentication activity.
• Review your ransomware incident response plan to ensure it addresses employee welfare, HR involvement and physical security considerations alongside technical recovery. Confirm that staff know who to contact if they receive a personal threat, and that your plan includes early engagement with law enforcement.
• Audit your development team's npm dependency practices. Ensure tooling is in place to scan for known malicious packages, that CI/CD pipelines enforce dependency integrity checks, and that developers have clear guidance on evaluating package provenance before use.
• Confirm that clear ownership exists across your organisation for each of these areas — MSP oversight, privileged access management, incident response planning and software supply chain security — so that review actions can be assigned and tracked effectively.

Secarma Insight

What today's stories collectively illustrate is that attackers are not always looking for a direct route into an organisation — they are increasingly targeting the trusted layers around it: the MSP platforms, the remote access tools, the open-source dependencies and the human responses to pressure. Mature security practice recognises that the perimeter is not just a network boundary but a web of trusted relationships, tools and processes, each of which needs to be understood, governed and monitored. Organisations that have clear ownership of their third-party relationships, well-maintained asset inventories and incident response plans that account for human as well as technical dimensions are far better placed to respond when something goes wrong. Good security is built on habits and structures that are already in place — not assembled in a hurry when an incident is already under way.