Weekly Briefing • October 16, 2026
On October 6, SonicWall published a fix for a flaw rated 10 out of 10 in one of its remote-access appliances. Two days later, decoy systems run by outside researchers were already catching attack traffic aimed at it. On October 8, the FBI arrested the co-founder of a firm that negotiates with ransomware groups on behalf of victims, on extortion charges. And Microsoft took down a marketplace that sold phishing kits and fraudulent Microsoft 365 accounts by the listing, behind roughly a billion phishing messages.
The thread this week is trust. In each story the damage runs through something that had already been trusted: the box that decides who gets onto your network from outside, the reputation of an old email account or a familiar name, and, if the charges hold up, the outside firm hired to sit on the victim's side of a ransom negotiation. Here's what happened, and what it means for how your firm operates.
A Patch Closes the Door. It Doesn't Tell You Who Already Came Through.
SonicWall disclosed CVE-2026-102255 on October 6, a flaw in the sign-in portal of its SMA 1000 Series, the appliances that let remote staff reach the office network. It carries a score of 10 out of 10, the maximum. Someone with no password can make the appliance send requests on their behalf, and because those requests come from the appliance itself, systems inside the network that refuse traffic from the internet accept them. SonicWall said there was "currently no evidence" of exploitation. Defused reported attack traffic against its SonicWall decoy systems starting October 8, and Previdian reported attempts against its own sensors on October 9. SonicWall has released a hotfix. This is the same product line the Inc ransomware gang broke into in July through two earlier flaws, CVE-2026-15409 and CVE-2026-15410, before fixes for them existed.
SonicWall says the SSL VPN built into its firewalls and its smaller SMA 100 Series are not affected, so if that is how your staff connect from home, this particular flaw is not yours. The pattern is. A remote-access box decides who gets onto your network and knows where everything inside it lives. It generally will not run the endpoint protection installed on your computers, so whatever happens on it shows up only in the logs the box itself keeps. The same week, Palo Alto Networks' Unit 42 described attackers who hid code in the memory of Fortinet firewalls, where it left nothing on disk, and who shut off the firewalls' own logging along the way. More on that one below.
Key Insight
A patch closes the way in. It does nothing about anything that came through before it was installed, so a remote-access box that sat on the internet unpatched gets treated as compromised until someone shows otherwise, and the passwords and certificates it held get changed either way.
There is a second cost that arrives whether or not anything goes wrong. Joe Toomey, vice president of underwriting security at the cyber insurer Coalition, told Dark Reading that edge devices produce a disproportionate share of claims and that SSL VPN devices "are almost uniformly bad." Coalition prices policies partly on what its underwriters can see exposed from outside your company and on the claims history of the vendor that made the box, so at least at one insurer, your remote-access equipment shows up in your renewal quote. For your firm, that comes down to two questions for whoever manages your firewall: what remote-access equipment can the internet reach, and when an emergency fix like this one comes out, does the work stop at the patch, or does it include changing every password, shared secret and certificate the box was holding? Full analysis here: SonicWall SMA SSRF Flaw CVE-2026-102255 Draws Exploitation Attempts Within Days of Disclosure.
Phishing Is a Store Now, and a Stolen Password Is the Stock
Microsoft's Digital Crimes Unit has taken down YAM Store, a marketplace that sold phishing kits alongside fraudulent Microsoft and Google accounts, as reported by CSO Online. Microsoft ties it to roughly 1 billion phishing messages aimed at more than 75,000 organizations, more than 750 million of them sent to Microsoft customers, and "tens of millions of dollars" for the people running it. Buyers shopped it like any other store: listings sorted by account age, subscription level and type, including school and nonprofit accounts, because an established account in an .edu or .org tenant has a sending reputation that a brand-new domain does not. The sellers also bought up domains that real organizations had let expire, rebuilt them to look active, and used them to obtain Microsoft 365 accounts to resell. The kits came with more than 2,300 ready-made pages impersonating healthcare providers, tax agencies, banks, courier services and police departments in more than 150 countries, and they were built to show a blank page to security scanners while the intended target saw a convincing sign-in screen.
Treat the takedown as disruption, not removal. The kits sold there, CoGUI, Haozi and the newer Iron Man System, can be sold elsewhere, and the people who bought them are customers who will shop somewhere else, so what reaches your staff's inboxes is unlikely to change much. What should change is how you think about one bad click. A password typed into one of these pages is not the end of the attack. It is inventory: the buyer may use the mailbox for invoice fraud this month and sell the same access to a ransomware crew the next, and the whole time, the sign-ins look like your employee's. The cleanup rule from earlier briefings still applies: end the stolen session, don't just change the password. The step that changes the economics is moving the accounts that matter most, starting with the owner's and whoever approves payments, to passkeys, so a password typed into a fake page is no longer enough to sign in and stops being worth selling. Full analysis here: Microsoft Disrupts YAM Store Phishing-as-a-Service Behind 1 Billion Messages.
The Firm That Talks to the Criminals Knows Your Price
The FBI arrested Edward Dubrovsky in Pennsylvania on October 8 on cyber extortion and conspiracy charges tied to its investigation of ShinyHunters, a data-theft and extortion group the FBI says has taken more than $70 million from victims this year. Dubrovsky co-founded Cypfer, a Canadian firm that negotiates with ransomware and extortion groups on behalf of the companies they hit, and is now associated with another Canadian firm, CyberSteward. He had been in Philadelphia for a cyber insurance conference where Cypfer was listed as the largest sponsor. The complaint is sealed, the case has moved to the Eastern District of Texas, and nothing has been proven. Sources told KrebsOnSecurity that charges against people at other negotiation firms may follow.
ShinyHunters does not encrypt anything. It phishes employees, signs in to cloud services with stolen passwords, pulls the data out through the application's own features, and threatens to publish it. When the break-in is that quiet, the money is made in the conversation afterward, and the negotiator on the victim's side of that conversation typically knows what was taken, what the insurance covers, and the number above which the victim will not pay. Two weeks ago the point here was that the list of businesses holding your patient or client records is longer than your list of software vendors. Add one more: whoever worked your last incident. If your firm has ever paid or negotiated over stolen data, find out who actually sat in that chat on your behalf, keep every record of the engagement, and tell your breach attorney and your cyber insurer this week rather than after a subpoena arrives. If it never has, the firm that would handle it often comes from your insurer's approved panel or through your breach attorney, not from a choice you make in the middle of an incident, so ask your broker at renewal which firms those are and how the carrier vets them. Full analysis here: FBI Arrests Founder of Ransomware Negotiation Firm Tied to ShinyHunters.
Also on Our Radar This Week
PEERSTITCH Malware Exploits FortiOS Flaws to Bypass Tagged VPN Session Checks — Unit 42 found an implant that lives only in the running memory of Fortinet firewalls and lets the attackers' VPN connections skip the firewall's own security checks. The group got there by first breaking into the central console a telecommunications managed service provider used to administer more than 500 of those firewalls, through a FortiManager flaw known since late 2024. Fortinet fixed the flaw used to plant the implant in April, and that is the point: a patched firewall can still be carrying it, a reboot erases the only evidence, and most owners in that position end up rebuilding the device from clean firmware. If someone else manages your firewalls, the console they manage them from is part of your perimeter too.
Four-Byte Write Bug Lets Researchers Run Code in Windows SmartScreen Enclave — Doyensec showed how to run their own code inside the walled-off part of Windows 11 that holds a hashed copy of your sign-in password for SmartScreen's phishing warnings, a region your endpoint protection cannot see into by design. It needs code already running on the PC, the researchers did not show a password being read, and Microsoft says it was not exploited before the September 8 update fixed it. That update is the entire fix. There is no setting that substitutes for it, and a PC that no longer receives Windows updates will never get it.
One Thing to Do This Week
Make a list of every domain name your firm has ever used: the current one, the practice name from before a merger or rename, the old website from before the redesign, anything a former partner registered. Then find the renewal invoice for each one, from your registrar, your web designer or your IT provider, and confirm it is still being paid. The YAM Store sellers bought domains that real organizations had let expire, rebuilt them to look active, and used them to get Microsoft 365 accounts to resell. A name your firm used for years has resale value to someone. If anyone wants to let one lapse to save the renewal fee, the answer is to ask whoever manages your email first. This one needs no help from IT.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
