Three enterprise attack surfaces are under active fire this week: VPN appliances, MSP management platforms, and public Wi-Fi gateways. Each one exploits a different trust assumption — that the appliance is patched, that the MSP’s tools are secure, that the hotel network is benign. None of those assumptions held.

In the News

INC Ransomware Gang Exploiting SonicWall SMA1000 for Root Access

The INC ransomware group is actively exploiting recent vulnerabilities in SonicWall SMA1000 series appliances to achieve root-level access on enterprise remote access gateways. SecurityWeek reported that post-exploitation activity includes lateral movement into internal networks — the SMA appliance serves as the beachhead, not the final target.

This is a familiar pattern. Enterprise VPN and remote access appliances sit at the network edge, accept inbound connections by design, and run with elevated privileges. When an attacker gains root on one, they inherit the appliance’s network position: inside the perimeter, trusted by internal systems, and often invisible to endpoint detection because the appliance itself is not running an EDR agent. The SMA1000 series is deployed across mid-size and large enterprises as a primary remote access solution, which means the blast radius per compromised appliance is substantial.

The immediate action is patching. The longer-term action is evaluating whether appliance-based remote access is an architectural risk your organization is willing to carry. Every appliance-based VPN gateway is one unpatched CVE away from giving a ransomware operator root access to your network edge. Zero-trust network access and SSE architectures remove the appliance from the equation entirely — there is no on-premises box to compromise because authentication and access decisions happen at the cloud edge.

What defenders should do: Confirm SMA1000 patch status immediately. If patching is delayed, isolate the appliance and restrict management access. Evaluate ZTNA/SSE as an architectural replacement for appliance-based VPN.

N-able Ships Second Patch for N-central Auth Bypass After First Fix Failed

N-able disclosed that attackers gained admin access to N-central instances via an authentication bypass tracked as CVE-2026-18577 — and that the first patch did not fully resolve the vulnerability. A second fix shipped in build 2026.3.1.7, which is the first unaffected version.

The operational implications extend beyond N-able’s customer base. N-central is a remote monitoring and management (RMM) platform used primarily by managed service providers. An attacker who gains admin access to an MSP’s RMM console inherits that MSP’s access to every customer environment the console manages. This is supply chain compromise through the management plane — the MSP did not need to be socially engineered or phished. The tool they use to manage customer networks handed the attacker the keys.

The failed-patch dimension adds a layer of urgency. MSPs that applied the first fix and assumed they were protected were still exposed. This erodes patch-trust at exactly the moment when rapid patching is the primary mitigation. Build verification matters: any N-central instance below build 2026.3.1.7 should be treated as potentially compromised, not merely unpatched.

What defenders should do: MSPs running N-central must upgrade to build 2026.3.1.7 immediately and audit admin access logs for unauthorized sessions during the window between the first and second patches. Enterprise customers should ask their MSP to confirm the specific build version in production. Privileged access management and microsegmentation limit the blast radius when management platforms are compromised.

Midnight Blizzard Harvesting Microsoft Credentials via Compromised Hotel Wi-Fi

Russian state-sponsored threat actor Midnight Blizzard (also tracked as APT29/Cozy Bear) is compromising public Wi-Fi gateways at hotels, airports, and conference centers to intercept Microsoft credentials from connecting business travelers. The attack leverages the captive portal infrastructure — users connecting to what appears to be legitimate hotel Wi-Fi have their authentication flows routed through attacker-controlled systems.

This is not a novel attack class, but the operator behind it elevates the severity. Midnight Blizzard is the same group behind the 2024 Microsoft corporate email breach and the SolarWinds supply chain compromise. Their targeting of hospitality network infrastructure reflects a strategic focus on environments where business travelers authenticate to corporate resources over networks they do not control. The technique maps to MITRE ATT&CK T1557 Adversary-in-the-Middle and T1078 Valid Accounts for the credential reuse phase.

The primary countermeasure is phishing-resistant MFA. FIDO2 security keys and passkeys are bound to the legitimate domain — even if a user’s password is intercepted through a compromised Wi-Fi gateway, the authentication ceremony cannot be replayed against the real Microsoft tenant. DNS-layer security provides a second line of defense by blocking connections to known command-and-control infrastructure regardless of the local network.

What defenders should do: Enforce phishing-resistant MFA (FIDO2/passkeys) for all Microsoft 365 and Azure AD authentication. Deploy DNS-layer security on all endpoints, including mobile devices used on untrusted networks. Brief traveling employees on the risk of authenticating to corporate resources over public Wi-Fi without an always-on secure tunnel.

GHOSTBLADE iOS Implant Deployed via Leaked DarkSword Exploit Kit

A Chinese threat actor is deploying the GHOSTBLADE iOS implant using DarkSword, a publicly leaked exploit kit. Censys researchers identified over 100 fake AWS login pages supporting the campaign, targeting enterprise users whose personal iOS devices access corporate resources through BYOD programs.

The campaign exploits a gap that most enterprises have not closed: mobile endpoint protection. While laptop and desktop endpoints typically run EDR agents and are enrolled in device management, personal iOS devices in BYOD programs often have minimal security controls — sometimes nothing beyond basic MDM enrollment. GHOSTBLADE leverages this asymmetry. The fake AWS login pages serve dual purposes: credential harvesting and initial payload delivery.

What defenders should do: Deploy mobile threat defense on iOS and Android devices accessing corporate resources. Enforce conditional access policies that verify device security posture (OS version, jailbreak status) before granting access. Block the fake AWS login domains at the DNS layer.

Defender Action Items

  • SonicWall SMA1000: Patch to the latest firmware immediately. If patching is delayed beyond 48 hours, restrict management interface access to a dedicated management VLAN and audit VPN session logs for anomalous root-level activity.
  • N-able N-central: Upgrade to build 2026.3.1.7 or later. Audit admin session logs for the window between the first and second patches. Enterprise customers: confirm your MSP’s N-central build version in writing.
  • Phishing-resistant MFA: Enforce FIDO2/passkey authentication for Microsoft 365, Azure AD, and AWS console access. The Midnight Blizzard Wi-Fi campaign and the GHOSTBLADE fake login pages both become non-viable against hardware-bound credentials.
  • Mobile endpoint protection: Deploy mobile threat defense on BYOD iOS and Android devices. Enforce conditional access policies that check device posture before granting corporate resource access.

Detection Queries

The following Splunk SPL query identifies anomalous VPN authentication patterns that may indicate exploitation of remote access appliances — specifically, multiple successful VPN authentications from the same source IP to different user accounts within a short window, which is consistent with post-exploitation credential reuse after appliance compromise:

index=vpn sourcetype=sslvpn OR sourcetype=sonicwall:sma
| stats dc(user) as unique_users values(user) as users earliest(_time) as first_seen latest(_time) as last_seen by src_ip
| where unique_users > 3
| eval time_window_minutes=round((last_seen - first_seen) / 60, 2)
| where time_window_minutes < 30
| sort -unique_users
| table src_ip unique_users users first_seen last_seen time_window_minutes

This query surfaces source IPs authenticating as more than 3 distinct users within a 30-minute window. In most environments, a single IP authenticating as multiple users in rapid succession is a high-fidelity indicator of credential stuffing or post-compromise lateral movement through the VPN gateway. Tune the unique_users threshold and time_window_minutes for your environment — high-NAT environments (hotel Wi-Fi, ironically) may require a higher threshold to reduce false positives.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.