The IT Risk Signals SMEs Cannot Ignore This Week

For small and mid-sized businesses, the latest cybersecurity news is less about one dramatic breach and more about a pattern: attackers are finding ordinary ways into trusted systems, then using cloud access, legitimate tools and weak recovery processes to create business disruption.

Introduction

News from the week ending September 27, 2026 points to a familiar but increasingly important lesson for business leaders. Cyber risk is now tightly connected to governance, identity management, supplier oversight and business continuity. A company can have antivirus software and still be exposed if an attacker can persuade a staff member to approve access, compromise a service account or quietly download files from a cloud platform.

The good news is that the practical response is not limited to large enterprises. Smaller organisations can materially reduce risk by tightening access controls, improving visibility, testing backups and giving staff a clear way to challenge unusual requests.

This week’s developments also show why cybersecurity should be treated as an operational issue, not only an IT issue. When systems, data or key people become unavailable, the consequences quickly move into customer service, cash flow, compliance and reputation.

1. Attackers are targeting cloud identities and service accounts

Microsoft reported a campaign involving compromised service principals, which are non-human identities used by applications and automation in cloud environments. The activity associated with Storm-3168 included reconnaissance, credential access and destructive actions in Azure environments, including resource deletion. Microsoft’s threat intelligence report describes how attackers can abuse trusted cloud relationships rather than relying only on traditional malware.

For a smaller business, the terminology may sound enterprise-focused, but the risk is not. Many SMEs use Microsoft 365, Azure, Google Workspace, accounting platforms, CRM systems and third-party integrations. These systems often depend on application identities, administrator accounts and automated connections that are created once and then rarely reviewed.

A compromised service account can be particularly damaging because it may operate without a person noticing an unusual sign-in. It may also have broad permissions, long-lived credentials or access to several systems. If it is used for backups, billing, file synchronisation or customer data processing, an incident can affect both security and continuity.

Why it matters for businesses

This is a governance problem as much as a technical one. Leaders need to know which automated identities exist, what they can access and who is responsible for them. If nobody owns an account, it may remain active long after the related project or supplier has ended.

The incident also reinforces the importance of separating production systems, backup environments and administrative access. If one identity can delete cloud resources and affect recovery data, a single compromise can become a business outage.

Practical actions

• Create an inventory of service accounts, application registrations, API keys and automated integrations.
• Assign a business and technical owner to every privileged identity.
• Remove unused accounts and reduce permissions to the minimum required for each task.
• Use short-lived credentials, managed identities or secrets management where the platform supports them.
• Require strong authentication and approval for privileged changes, including the creation of new applications and service principals.
• Alert on unusual resource deletion, new administrator consent, changes to authentication methods and sign-ins from unfamiliar locations.
• Keep backups protected by separate credentials that cannot be used to delete both primary data and recovery copies.

2. Ransomware affiliates are standardising their playbooks

Microsoft also published an analysis of Storm-2570, a ransomware affiliate group linked to deployments involving several ransomware brands. The report highlights consistent post-compromise tools and techniques used across different operations. The Microsoft ransomware analysis shows why defenders should focus on attacker behaviour rather than waiting for a particular ransomware name to appear.

The practical point is that ransomware operations are becoming more repeatable. Criminal groups can use the same remote administration tools, credential theft methods, discovery commands and data collection techniques across different ransomware partnerships. The final encryption event is often only one stage of a much longer intrusion.

This matters for SMEs because the visible ransomware event may arrive after attackers have spent days or weeks inside the environment. They may first investigate financial systems, identify executives, locate legal or customer files and test how quickly the organisation notices unusual activity.

Why it matters for businesses

A business continuity plan that only says restore from backup is incomplete. Management also needs to consider how the attacker entered, whether credentials must be replaced, how systems will be isolated, how customers will be notified and how the business will operate while systems are unavailable.

The presence of multiple ransomware brands also means that buying a product marketed as protection against one named group is not a complete strategy. Resilience comes from reducing the opportunities available to many types of attackers.

Practical actions

• Confirm that endpoint detection and logging cover servers, laptops, cloud identities and remote access systems.
• Review the use of remote monitoring and management tools, especially tools that can run scripts or access many devices.
• Segment critical systems so an incident on a standard workstation cannot automatically reach finance, production or backup networks.
• Test offline or immutable backups by restoring real files and systems, not merely checking that a backup job completed.
• Define an incident response sequence covering containment, evidence preservation, legal advice, insurance notification and customer communication.
• Run a tabletop exercise with business leaders, IT support, finance and communications staff.
• Make sure senior managers know who can authorise a shutdown, isolate systems or invoke manual workarounds.

3. Identity phishing is moving beyond ordinary password theft

Microsoft’s recent reporting on the EvilTokens platform describes an active phishing ecosystem built around device-code authentication. In these attacks, a victim may be persuaded to enter or approve a code that gives an attacker access to a legitimate cloud session. The lure can be presented as a passkey setup, single sign-on update, account verification request or helpdesk process. Microsoft’s research on device-code phishing explains why the activity can be difficult to identify if teams focus only on passwords.

A related Microsoft investigation described social engineering that begins with phone calls or messages claiming to be from an IT helpdesk. The attacker then directs the employee to a convincing sign-in page or authentication flow. After access is obtained, the attacker may add a new authentication method, explore Microsoft 365 applications and download files from SharePoint or OneDrive over time.

Why it matters for businesses

MFA remains essential, but not every MFA interaction is equally resistant to social engineering. A user who is pressured into approving a malicious request may unintentionally help the attacker bypass the control.

This is especially relevant to small businesses where one person may perform several roles, staff work remotely and helpdesk processes are informal. Employees may be more willing to trust a caller who knows the company name, the manager’s name or the details of a current project.

A compromised cloud identity can expose email, contracts, payroll information, customer records and intellectual property without triggering the obvious signs associated with malware. It can also create a serious privacy and regulatory issue if data is accessed or copied.

Practical actions

• Prefer phishing-resistant MFA, such as passkeys or security keys, for administrators and high-risk users where practical.
• Block device-code authentication flows unless there is a documented business need.
• Restrict who can register new authentication methods and require additional verification for helpdesk resets.
• Establish a verified channel for staff to confirm unusual IT requests. The safe response should be to hang up and call a known number, not to continue the conversation.
• Train employees to report unexpected MFA prompts, passkey requests, sign-in codes and urgent calls about account security.
• Monitor for new authentication methods, risky sign-ins, unusual mailbox rules and high-volume downloads from cloud storage.
• Limit access from unmanaged devices and review whether users really need the ability to download or synchronise sensitive files.

4. Australian organisations are being warned to govern AI use more carefully

The Australian Cyber Security Centre published an alert on September 24 about risks associated with AI misalignment in Australian organisations. The guidance is aimed at businesses of different sizes and focuses on secure AI practices, including the need to understand how AI tools are selected, configured and used. The Australian advisory places AI risk in a broader governance context rather than treating it as only a software issue.

For an SME, AI governance does not need to begin with a large committee or a lengthy policy manual. It should begin with visibility. Leaders need to know which AI tools staff are using, what information is being entered, which tools can connect to business systems and who is accountable for the results.

The risk is not limited to confidential information being pasted into a public chatbot. AI tools may also create incorrect content, make poor recommendations, expose sensitive prompts through integrations or be granted more access than the business intended. If an AI assistant can read email, documents or customer records, it must be governed like any other system with access to business data.

Why it matters for businesses

Poorly controlled AI use can create privacy, contractual, intellectual property and reputational problems. It can also weaken business continuity if staff become dependent on an unapproved service that changes its pricing, access model or availability.

AI governance is therefore part of IT risk management. The organisation should be able to explain what the tool is used for, what data it can access, what human review is required and what happens if the service is unavailable.

Practical actions

• Maintain a simple register of approved AI tools, business owners and connected data sources.
• Prohibit staff from entering passwords, payment information, sensitive customer details or confidential commercial material into unapproved services.
• Review the privacy, security and data retention terms of AI suppliers before connecting them to business systems.
• Use role-based access and separate testing environments for AI tools that connect to email, documents or business applications.
• Require human review for financial, legal, employment, safety and customer-facing decisions.
• Define an exit plan for critical AI services, including how data will be exported and how staff will work during an outage.
• Revisit AI policies quarterly because tools, integrations and usage patterns can change quickly.

5. Human behaviour is becoming a measurable security control

A recent industry analysis on secure behaviour management argued that organisations are shifting from occasional awareness training to continuous measurement of how people respond to security risks. The focus is on practical behaviour change, such as reporting suspicious messages, using approved processes and resisting pressure from impersonators. The industry analysis reflects a wider change in security programs.

This is important because many incidents begin with a normal business interaction. A phone call from a supposed supplier, an urgent invoice change, a recruitment message, a request to share a document or a prompt to approve access can all be used as an entry point.

Training that consists of one annual presentation is unlikely to prepare employees for fast-moving, personalised attacks. Staff need short, relevant reminders and a safe process for asking questions. They also need to know that reporting a suspicious request is valued even when the request turns out to be legitimate.

Why it matters for businesses

A culture that discourages questions creates risk. Employees who fear criticism may ignore an unusual request or delay reporting a mistake. That delay gives attackers more time to move through cloud accounts, redirect payments or steal data.

Behaviour management should not become a blame exercise. The goal is to improve processes and reduce the number of situations in which one pressured employee can cause a major incident.

Practical actions

• Run short, role-specific training for finance, executives, administrators, sales staff and customer support teams.
• Use realistic examples involving voice phishing, supplier fraud, fake helpdesk calls and unusual document-sharing requests.
• Create an easy reporting button, email address or phone process that staff can use without fear of punishment.
• Measure reporting rates, response times and completion of follow-up actions, not just training attendance.
• Review whether policies are practical during busy periods, remote work and after-hours support.
• Use approval controls for payment changes, privileged access and sensitive data sharing.
• Recognise good reporting behaviour and share lessons without identifying individual employees unnecessarily.

What This Means For Your Business

The strongest common thread across this week’s news is that attackers are exploiting trust. They are abusing legitimate cloud identities, trusted applications, routine support processes and normal business communications. That means security cannot be delegated entirely to a firewall or antivirus platform.

Start with a short risk review. List your most important systems, the identities that can access them, the suppliers that support them and the business processes that would stop if those systems were unavailable. Then identify the first three improvements that would reduce the greatest risk, such as stronger MFA, better backup isolation or a tested incident response plan.

For Australian businesses, use the Australian Cyber Security Centre’s alerts and guidance as a regular input to management discussions. Keep the process simple: identify what applies to your environment, assign an owner, record the action and check that it was completed. Smaller organisations can also use a trusted managed IT or security provider to fill visibility and response gaps without building a large internal team.

Cyber resilience is not about predicting every attack. It is about making common attacks harder, detecting problems earlier and giving the business a reliable way to keep operating while the issue is contained. A few well-governed controls, tested regularly, will usually deliver more value than a long list of tools that nobody owns.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.