The SME Cyber Risk Reset: What This Week’s IT News Means for Business Continuity

Cloud identities, exposed enterprise software, ransomware disruption and new reporting duties all featured in the technology and cybersecurity news cycle from 28 September to 4 October 2026. For small and mid-sized organisations, the common theme is simple: resilience now depends less on owning sophisticated tools and more on controlling access, testing recovery and making clear decisions before an incident occurs.

This week’s stories also show why cybersecurity is an IT governance issue rather than a purely technical concern. A compromised service account can damage cloud infrastructure, an unpatched business application can expose sensitive systems, and a ransomware incident can create legal, insurance, operational and reputational consequences at the same time.

The good news is that most of the practical lessons are achievable for smaller organisations. Businesses do not need a large security operations centre to improve their position. They do need visibility, sensible controls, tested procedures and leadership that treats cyber risk as part of business continuity planning.

1. Agentic attacks put cloud identities at the centre of risk

A major vendor advisory reported new activity linked to the JadePuffer operation, tracked by Microsoft as Storm-3168. Attackers used compromised Azure service principals, which are machine identities used by applications and automation, to investigate cloud environments and attempt destructive actions.

The reported activity included the discovery of storage, virtual machines, application services, key stores and other resources. In one attack sequence, the destructive phase lasted only a few minutes but attempted to delete more than 100 storage accounts and other cloud assets. The activity followed a longer period of automated reconnaissance and credential collection.

The incident matters because many SMEs have moved quickly into cloud platforms without applying the same governance discipline to machine identities that they apply to employees. A service principal may have broad permissions, a long-lived secret and little day-to-day oversight. If that identity is compromised, an attacker may be able to act at machine speed and reach systems that staff never access manually.

The story should not be read as proof that every AI system is about to become an autonomous attacker. The more immediate risk is familiar: exposed credentials, excessive permissions and weak monitoring. Automation simply makes those weaknesses faster and easier to exploit.

Practical actions for business leaders:

• Create an inventory of service principals, API keys, application accounts and other non-human identities.
• Remove unused accounts and rotate secrets that have been exposed, shared informally or left unchanged for long periods.
• Apply least-privilege access so applications can perform only the tasks they genuinely require.
• Enable alerts for unusual resource discovery, mass deletion, credential access and changes to backup or recovery controls.
• Separate production, testing and backup environments so one compromised identity cannot affect everything.

The Microsoft security research coverage and independent reporting on the Azure activity both point to the same governance lesson: cloud resilience depends on identity controls, not simply on the fact that systems run in the cloud.

2. Oracle PeopleSoft exploitation shows why patching must be risk-led

Google Threat Intelligence reported a renewed exploitation campaign against Oracle PeopleSoft systems involving CVE-2026-35273. The campaign was associated with the ShinyHunters group and had expanded beyond its earlier focus on academic organisations to multiple sectors.

The advisory highlighted a practical problem for defenders. Attackers modified their requests to bypass simple web application firewall rules that looked for the vulnerable endpoint in an expected format. In other words, a control that appeared to block the attack could be bypassed when it relied on a narrow pattern rather than fixing the underlying software.

For an SME, the lesson is not limited to PeopleSoft. Many businesses depend on older finance, payroll, customer management, document or enterprise resource planning systems that are difficult to update. Some are managed by a third party, while others sit behind a firewall and are assumed to be safe because they are not publicly advertised.

That assumption is risky. Internet-facing systems are continually scanned, and attackers often target the software that connects business processes to sensitive data. If a patch cannot be applied immediately, temporary controls need to be documented, monitored and reviewed rather than treated as a permanent solution.

Practical actions for business leaders:

• Maintain a current register of business-critical applications, versions, owners and vendors.
• Prioritise vulnerabilities based on exploit activity, internet exposure, data sensitivity and business impact, not just the severity score.
• Confirm with managed service providers that security updates have actually been applied and recorded.
• Treat web application firewall rules as a layer of defence, not a substitute for patching.
• Remove unsupported software from the business roadmap and assign a realistic replacement or containment date.

The Google Cloud threat intelligence advisory is particularly relevant to governance teams because it connects technical exposure with ownership. Someone in the organisation must know which system is affected, who can approve downtime and what temporary measures are acceptable.

3. The KillSec takedown is encouraging, but it does not reduce the need for preparation

On 1 October, Eurojust announced an international operation against the KillSec ransomware group. Authorities in nine countries coordinated the seizure of infrastructure and identified several suspected participants, including a 16-year-old believed to have been the group’s main operator. Investigators said KillSec had been linked to almost 1,000 attacks worldwide.

The operation is a positive reminder that international law enforcement and security companies can disrupt criminal infrastructure. It may also provide useful intelligence about the group’s methods, victims and supporting services.

However, a takedown is not a continuity plan. Ransomware groups regularly rebrand, split into affiliates or move to new infrastructure. Even when one group disappears, the underlying business model remains attractive. Criminals can still obtain access through stolen credentials, poorly protected remote services, vulnerable edge devices, cloud storage and trusted suppliers.

For smaller businesses, the financial impact of ransomware is often caused by downtime rather than encryption alone. Staff cannot access files, orders cannot be processed, customers may not receive service and management may struggle to establish what happened. A strong backup is useful only if it is protected from the same incident and can be restored within a timeframe the business can tolerate.

Practical actions for business leaders:

• Define the systems and services that must be restored first, including email, finance, customer records, production and communications.
• Set recovery time and recovery point objectives in plain business language.
• Keep at least one backup copy isolated from normal administrator accounts and production networks.
• Test restoration regularly, including a full recovery of a representative system rather than only checking that a backup job completed.
• Prepare a ransomware playbook covering internal decisions, legal advice, insurer notification, customer communications and contact with authorities.

The Eurojust announcement is worth reading as a governance story, not just a crime story. It shows the scale of the threat and reinforces why incident response should be agreed before the pressure of an outage, ransom demand or data leak.

4. Australian ransomware reporting makes incident governance more important

An Australian legal analysis published on 28 September highlighted the continuing effect of mandatory ransomware payment reporting under the Cyber Security Act 2024. Reporting businesses must notify the Australian Signals Directorate within 72 hours of making a ransomware or cyber extortion payment, or becoming aware that a payment was made on the entity’s behalf, where the regime applies.

Not every small business falls within the same reporting threshold, and obligations can depend on the organisation’s size, role and circumstances. That is precisely why businesses should not try to determine their responsibilities for the first time during an incident.

The wider point is that ransomware is now a governance event with multiple workstreams. A company may need to preserve evidence, assess privacy obligations, deal with customers and suppliers, notify an insurer, manage directors’ responsibilities and decide whether operations can continue safely. A technical team cannot make all of those decisions alone.

Australian SMEs should also remember that contractual obligations may be broader than statutory requirements. A customer, government buyer, insurer or major supplier may require notification within a particular timeframe or expect evidence of security controls. The cost of poor preparation can therefore extend well beyond a single incident.

Practical actions for business leaders:

• Ask legal and insurance advisers which ransomware, privacy and contractual obligations apply to the organisation.
• Document who has authority to approve incident communications, payments, system shutdowns and customer notifications.
• Keep current contact details for the Australian Signals Directorate, the Australian Cyber Security Centre, insurers, legal advisers and key technology providers.
• Include evidence preservation in the incident plan so logs, emails and forensic information are not accidentally lost.
• Review cyber insurance wording, especially requirements for security controls, consent and notification.

The recent Australian legal commentary is a useful prompt for directors and managers to connect cyber response with compliance, insurance and operational risk. The details should be verified with qualified advisers, but the preparation principle is broadly applicable.

5. Apple’s latest zero-day reminder: the endpoint still matters

Apple security updates reported this week included a fix for CVE-2026-86950, a vulnerability in the CoreGraphics framework that was described as potentially exploited in highly targeted attacks. SecurityWeek reported the update on 29 September, with the affected ecosystem including Apple devices used by many executives, sales teams, consultants and remote workers.

Mobile phones and laptops are often treated as secondary to servers and cloud platforms. In practice, they are valuable entry points. A compromised endpoint can expose email sessions, authentication tokens, customer conversations, files and access to business applications. It can also be used to approve fraudulent requests or defeat security controls that rely on trusted devices.

SMEs do not need to monitor every technical release manually, but they do need a dependable process for supported devices. A device that cannot receive security updates should have a clear replacement or isolation plan.

Practical actions for business leaders:

• Use mobile device and endpoint management to track operating system versions and encryption status.
• Require automatic updates where business applications support them, while planning for compatibility testing.
• Enforce phishing-resistant or app-based multifactor authentication for high-value accounts.
• Block access from unsupported or unregistered devices where practical.
• Remind staff that an urgent update request should be verified through normal IT channels, especially during a busy incident.

The SecurityWeek report reinforces an important point for continuity planning: an endpoint incident can quickly become an identity and access incident. Device management, MFA and account recovery procedures should therefore be planned together.

What This Means For Your Business

This week’s news is not a reason to panic or purchase every security product on the market. It is a reason to examine the few controls that have the greatest effect on business continuity. Start with identity. Know which people, applications and suppliers can access important systems, and reduce permissions that are no longer justified.

Next, test recovery. Ask how long the business could operate without email, finance, customer records or core production systems. Then check whether the answer is supported by a tested restoration process. A backup that has never been restored is an assumption, not a recovery capability.

Finally, turn incident response into a management process. Make sure the right people know who decides, who communicates and who contacts regulators, insurers and customers. Review these arrangements at least annually and after major technology or supplier changes.

For Australian SMEs, practical cyber resilience is built through repeatable habits: patch exposed systems, protect machine identities, require strong authentication, monitor important changes, train staff and rehearse the first 24 hours of an incident. These measures reduce both the likelihood of disruption and the time it takes to recover when prevention fails.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.