Cybercave TechnologiesVeteran-owned · Southwest Michigan

← Back to Tech News

The Tools Your IT Helper Uses Were This Month's Biggest Targets

In the first half of October, attackers went after remote-support software, office VPNs, backup servers and a cloud provider that 495 companies and local governments relied on. The lesson for small businesses: ask where your backups really live.

By Cybercave Technologies

Most small businesses don't run their own security team. They depend on a handful of tools, often managed by an outside IT provider: software that lets a technician connect to your PC from afar, a VPN so staff can work from home, a backup system and a cloud host. In the first half of October 2026, every one of those categories showed up in an urgent government warning or a major incident.

Remote-support software under active attack (Oct. 15–16)

Confirmed: On Oct. 16, CISA urged organizations to patch a critical flaw in BeyondTrust Remote Support (formerly Bomgar), tracked as CVE-2026-102764, and listed it as known to be exploited. CISA says attackers are using the flaw to get in, then entrenching themselves, raising their privileges and moving deeper into networks. BeyondTrust's own advisory (BT26-05, Oct. 15) rates it critical and says all Remote Support versions 26.2.3 and earlier are affected. Its cloud-hosted customers were patched Oct. 9. Self-hosted customers on versions 24.3.1 through 26.2.3 must apply BeyondTrust's BT26-05-RS patch; anyone on a version older than 24.3.1 has to upgrade first before the patch can be applied.

Attributed: Google's Mandiant team reports that a suspected China-linked espionage group it calls ARMORY CASTLE was quietly exploiting the flaw as early as late August, weeks before it became public. On compromised appliances, Mandiant says the group tried to pull out stored passwords and used the tool's own remote-session features to copy files off users' desktops. Mandiant also warned that other criminals often pile on once a flaw like this becomes public.

Office VPNs, firewalls and email gateways (Oct. 13–14)

Confirmed: On Oct. 13, CISA urged immediate patching of a zero-day flaw in Ivanti Connect Secure, a VPN product widely used for remote work (CVE-2026-104935). CISA says the flaw lets an attacker skip the login and run commands remotely, and that it has been used to steal credentials and data. Affected versions include 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. CISA warns that Ivanti's own Integrity Checker tool may not detect a compromise, and its recovery guidance for exposed devices includes a factory reset and password resets. Ivanti's 22.8 line reaches end of life Jan. 31, 2027.

The next day, CISA added actively exploited flaws in Palo Alto Networks PAN-OS firewall software (CVE-2026-0322) and Cisco Secure Email Gateway (CVE-2026-76519) to its known-exploited list.

Backup servers (Oct. 7–13)

Confirmed: CISA's Oct. 14 additions also included two flaws in AhsayCBS (CVE-2026-105133 and CVE-2026-105134), a backup management server that security firm Huntress says is mainly used by managed service providers, the outside IT companies many small businesses hire. Huntress reported attackers chaining the two flaws starting Oct. 7 to take full control of exposed servers, and by Oct. 8 it had seen five organizations targeted. In the cases it saw, attackers planted backdoors and cryptocurrency-mining software disguised as Microsoft Edge.

Ahsay's own status page says partners first reported unauthorized access on Oct. 9. Ahsay released a hotfix for version 10 (v10.3.4.45) on Oct. 10 and for version 9 (v9.15.2.70) on Oct. 12; customers on versions 7 or 8 must first upgrade to 9.15.0.0. On Oct. 13 it published compromise guidance that recommends a full rebuild of affected servers.

Huntress said it had not seen backup data stolen or wiped in these cases. But anyone who controls a backup server can reach the copies a business would depend on during a ransomware attack.

When your cloud host is the victim (Oct. 7 – ongoing as of Oct. 17)

Confirmed: On Oct. 7, Japanese cloud provider IDC Frontier, a SoftBank subsidiary, said ransomware had disrupted part of its IDCF Cloud service, affecting 495 companies and local governments (company notice; also reported by BleepingComputer and ITmedia). On Oct. 8 the company said retrieving or restoring customer data looked difficult, Nikkei xTECH reported.

In its Oct. 14 update, IDC Frontier said 194 snapshot customers can retrieve their snapshot backup data; restoration is case-by-case, and the company is contacting each customer about whether and how data can be delivered (ASCII.jp; Nikkei xTECH). For the other 301 affected customers, the company's update describes no snapshot-recovery route. The same update said an outside security firm found no evidence that customer server data was viewed or exfiltrated, and that registration data for 48 customers was improperly queried through the customer portal, with no evidence it was taken out. As of Nikkei's Oct. 16 report, the four affected zones were still offline, and some customers were rebuilding elsewhere with the data they retrieved. The company told Nikkei it has identified the intrusion route but won't disclose it.

Unverified: A message from the attackers shown on customers' consoles, reported by BleepingComputer, claims they wiped 554,153 snapshots. IDC Frontier has not confirmed that figure.

Why this matters in Allegan County, not just Tokyo

Confirmed (FBI data): The FBI's 2025 Internet Crime Report says IC3 received more than 1,400 ransomware complaints from businesses and organizations outside the 16 critical-infrastructure sectors. Among those non-critical-sector complaints, the most-reported industries were legal services (18%) and contracting services, such as electricians and general contractors (17%), followed by engineering and architecture firms (10%). The FBI doesn't break these figures down by business size, but they are trades that many local small businesses work in.

What this means for small businesses in Allegan and surrounding counties

  • Ask your IT provider three direct questions this week: (1) Do you use BeyondTrust, Ivanti, AhsayCBS, Palo Alto or Cisco email products on our systems or yours? (2) If so, are they patched against the October flaws CISA flagged (and, for BeyondTrust, is the version new enough to take the patch)? (3) Have you checked for signs of a break-in? CISA's advice is that patching alone isn't enough if a device was exposed before the fix.
  • Know where your backups live. If your only backup sits in the same cloud account, or is run from the same console as your live systems, one compromise can take out both. IDC Frontier's customers learned that this month. A common rule of thumb is to keep at least one copy somewhere separate and offline or locked, and to actually test a restore.
  • Remote-access tools should be locked down, not left open to the internet. CISA's guidance for BeyondTrust includes limiting who can reach admin screens, resetting stored passwords if there was any exposure, and reviewing multifactor sign-ups on privileged accounts.
  • No vendor or patch guarantees safety. The goal is to make your business harder to hit than the next one, and to recover quickly if something does happen.

Sources (all accessed/as of Oct. 17, 2026)

  1. CISA, "CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support," Oct. 16, 2026 (primary) — https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support
  2. Google Cloud / Mandiant, "ARMORY CASTLE Exploits BeyondTrust," Oct. 15, 2026 — https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/
  3. BeyondTrust, Security Advisory BT26-05, issued Oct. 15, 2026 (all RS ≤26.2.3; SaaS patched Oct. 9; BT26-05-RS patch for 24.3.1–26.2.3; upgrade first if older) (primary) — https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
  4. CISA, "CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure," Oct. 13, 2026 (primary) — https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
  5. CISA, "CISA Adds Four Known Exploited Vulnerabilities to Catalog," Oct. 14, 2026 (PAN-OS CVE-2026-0322, Cisco SEG CVE-2026-76519, AhsayCBS CVE-2026-105133/105134) (primary) — https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog
  6. Huntress, "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer," Oct. 8, 2026, updated Oct. 12 — https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  7. Ahsay, "AhsayCBS Vulnerability Status Update," as updated Oct. 13, 2026 (Oct. 9 partner reports; Oct. 10 and Oct. 12 hotfixes; Oct. 13 rebuild guidance) (primary) — https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update
  8. IDC Frontier (official notice, Japanese), "【第2報】当社サービスの一部システムに対する不正アクセスについて," Oct. 7, 2026 (495 companies and local governments) (primary) — https://www.idcf.jp/news/topics/20261007002
  9. BleepingComputer, "Ransomware attack disrupts Japan's IDCF Cloud used by govt clients," Oct. 8, 2026 (incl. attacker's console message claiming 554,153 snapshots wiped) — https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/
  10. ITmedia NEWS (Japanese), Hinako Umebayashi, IDCF Cloud ransomware affects 495 companies and municipalities, Oct. 7, 2026 — https://www.itmedia.co.jp/news/article/2610/07/2000002107/
  11. ASCII.jp English Edition, "IDC Frontier: Backup Data Now Retrievable for 194 Customers," Oct. 15, 2026 (Oct. 14 fifth notice; 194 retrievable, restoration case-by-case; 48 portal records) — https://ascii.jp/en/elem/000/004/442/4442704/
  12. Nikkei xTECH (Japanese), Yudai Nagata, "IDCFクラウド障害、194組織のデータが取り出し可能に 侵入経路は特定," Oct. 16, 2026 (Oct. 8 third notice; no external leak of VM data; intrusion route identified, not disclosed; zones still stopped) — https://xtech.nikkei.com/atcl/nxt/column/18/03790/101600006/
  13. Hard2bit, "IDCF Cloud ransomware: 194 of 495 IDC Frontier customers may recover their snapshots," Oct. 16, 2026 (corroborates the fifth notice's "no evidence … viewed or exfiltrated" finding; used for that point only) — https://hard2bit.com/en/blog/idcf-cloud-ransomware-snapshots-backups-outside-cloud-provider/
  14. FBI IC3, 2025 Internet Crime Report (non-critical-sector ransomware industries) (primary) — https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

For general information only — not advice for your specific situation.

Email