Today’s briefing covers three active threats that exploit gaps in oversight and attention. First, Huntress published a timeline of an INC ransomware attack that compromised 175 endpoints after a 17-day period of apparent dormancy, demonstrating how patient adversaries use dwell time as a weapon. Second, Cisco Talos released details of CLOSEDQUORUM, the first documented malware implant exhibiting fully autonomous command and control capabilities, alongside their new CAIRN research toolkit designed to hunt AI-integrated threats. Third, D-Link disclosed a maximum-severity remote code execution vulnerability in the DIR-822A router with no patch available and a public exploit already circulating. All three threats share a common characteristic: they operate in the spaces between human monitoring cycles, relying on the assumption that reduced visibility equals reduced risk. This episode provides specific, actionable guidance for UK small businesses on securing remote access, implementing behavioural monitoring, and conducting immediate network hardware audits.
