NCSC Edge Device Warning, Manchester Airports Breach, and Teams Vishing

Today’s briefing examines three urgent threats to UK small businesses. The NCSC has issued a fresh alert on internet-exposed edge devices, highlighting persistent failures in patch management and configuration that attackers are actively exploiting. Manchester Airports Group has confirmed a breach affecting 8.7 million UK customers, creating significant downstream phishing risk through compromised travel data. Zscaler research details an ongoing Microsoft Teams vishing campaign deploying the GoGRPC backdoor, demonstrating how ransomware operations have industrialised initial access through collaboration platforms. The episode provides specific, actionable guidance for each threat, from verifying patch dates on VPN appliances to configuring Quick Assist controls and preparing staff for contextualised spear-phishing. We also note the arrest of two individuals connected to TeamPCP supply chain attacks. Each story is framed through the operational gaps that enable these threats, with practical steps UK SMBs can implement today.

Chapters

• Introduction Overview of three urgent threats: NCSC edge device alert, Manchester Airports data breach, and industrialised ransomware access via Microsoft Teams.
• NCSC Alert on Internet-Exposed Edge Devices Analysis of the NCSC advisory on disruptive incidents linked to unpatched VPNs, firewalls, and edge devices. Covers operational failures in patch management, specific checks for UK SMBs, and the critical Fortinet EMS vulnerability CVE-2026-35616.
• Call to Action Invitation to follow the show and share with colleagues.
• Manchester Airports Group Data Breach Examination of the 8.7 million customer breach, the downstream spear-phishing risk from exposed travel data, and practical steps for businesses whose staff or customers may be affected.
• Microsoft Teams Vishing Campaign and GoGRPC Backdoor Detailed analysis of Zscaler research on Teams-based social engineering delivering the GoGRPC backdoor. Covers the attack pattern, configuration controls for Quick Assist, and staff training requirements.
• TeamPCP Supply Chain Arrests Brief note on arrests connected to developer supply chain attacks, highlighting ongoing exposure for UK SMBs using third-party software.
• Closing Summary and Actions Consolidated practical guidance: verify patch dates, configure Quick Assist controls, brief staff on Teams vishing, and assess Manchester Airports exposure.

Links

• https://www.ncsc.gov.uk/
• https://www.esentire.com/
• https://www.zscaler.com/
• https://ico.org.uk/