Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

•

Episode description

Zero-Day Remote Access Exploit, AI-Driven PaperCut Campaign, DragonForce Cartel

On 16 October 2026, three active threat campaigns demand immediate attention from UK small businesses. First, a zero-day vulnerability in BeyondTrust Remote Support appliances (CVE-2026-102764) has been exploited since late August by ARMORY CASTLE, a suspected Chinese state-linked actor, targeting the IT provider supply chain. Second, an AI-orchestrated exploitation campaign against PaperCut print management software is operating automatically across 45-plus countries, representing a fundamental shift in attack velocity and scale. Third, DragonForce ransomware has evolved from opportunistic operation to sophisticated cartel offering white-label services, with affiliates exploiting vulnerabilities including the nearly five-year-old Log4Shell. A supplementary proxyjacking campaign (skynox-7) has compromised at least 143 network edge devices globally. The common thread: known vulnerabilities, unpatched systems, and IT tooling that business owners have never inventoried. All three campaigns are confirmed active, documented by Mandiant, Hunt.io, ReliaQuest, Bitsight, and GreyNoise. This briefing provides actionable guidance for businesses that may be exposed through their IT providers or their own infrastructure, with specific questions to ask and checks to run today.

Chapters

  • Introduction Overview of three confirmed, active threat campaigns directly relevant to UK small businesses: a zero-day in remote support software, an AI-orchestrated print management exploit, and a restructured ransomware cartel.
  • ARMORY CASTLE BeyondTrust Zero-Day Exploitation Analysis of CVE-2026-102764, a zero-day in BeyondTrust Remote Support exploited by suspected Chinese state actor ARMORY CASTLE since late August 2026, including post-exploitation techniques and supply chain implications for businesses using managed IT providers.
  • Mid-Episode Call to Action Invitation to follow the show and share with fellow business owners.
  • AI-Orchestrated PaperCut Exploitation Campaign Examination of automated exploitation targeting PaperCut NG/MF print management software across 45-plus countries, using AI agents to execute attacks at unprecedented scale and speed, with implications for professional services and healthcare sectors.
  • DragonForce Ransomware Cartel Evolution Assessment of DragonForce’s transformation from opportunistic ransomware operator to white-label cartel model, including exploitation of Log4Shell and other years-old vulnerabilities still present in UK business environments.
  • Skynox-7 Network Edge Device Proxyjacking Brief on proxyjacking campaign compromising NAS, NVR, and DVR devices globally, turning business hardware into criminal proxy infrastructure through exploitation of known vulnerabilities and default credentials.
  • Closing and Action Items Summary of common vulnerabilities across all campaigns and specific questions business owners should ask their IT providers immediately.

Links