--- title: Cyber Risk Is Moving Beyond the User description: This week's threat intelligence highlights the shift in cyber security focus from human identities to the protection of application credentials and trusted systems. image: https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/Cybersecurity%20Team%20at%20Modern%20Office%20Conference.png --- [Skip to content](https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user#main-content) [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://www.digitalfrontierpartners.com.au/) - [Services](https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) Open main navigation Close main navigation - [Services](https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user#products) Show submenu for Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) - Resources Show submenu for Resources - [News](https://digitalfrontierpartners.com.au/news/tag/news) - [Case Studies](https://digitalfrontierpartners.com.au/news/tag/case-study) - [Research](https://digitalfrontierpartners.com.au/news/tag/research) - [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) - [About](https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user#about) Show submenu for About - [About Us](https://digitalfrontierpartners.com.au/about) - [Contact Us](https://digitalfrontierpartners.com.au/contact) - [Contact us](https://digitalfrontierpartners.com.au/contact) [Contact us](https://digitalfrontierpartners.com.au/contact) 20 October 2026, 9:15:25 am AEDT # Cyber Risk Is Moving Beyond the User ![Picture of Digital Frontier Partners](https://digitalfrontierpartners.com.au/hs-fs/hubfs/500x%20DFP%20(3).png?width=50&name=500x%20DFP%20(3).png) [Digital Frontier Partners](https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners) For years, cyber security has centred on protecting people: stronger passwords, MFA, phishing awareness and endpoint controls. This week's threat intelligence shows why that model is no longer enough. Increasingly, attackers are going after the identities and technologies operating quietly behind the scenes, including application credentials, software suppliers, remote-access appliances, CI/CD pipelines and machine-to-machine integrations. The compromise involving ConnectWise illustrates the risk particularly well. Stolen application credentials enabled unauthorised Microsoft Graph access to customer Microsoft 365 tenants without requiring users' passwords or bypassing their MFA. Huntress identified suspicious activity across nearly 1,000 tenants, including around 300 successful sign-ins. The extent of any data theft remains unclear. For Australian organisations, the broader message is important: protecting human identities is only part of the challenge. Application identities, supplier integrations, software updates and security appliances increasingly deserve the same scrutiny as privileged users. --- **Executive Summary** Supply-chain and third-party compromise dominated this week's reporting. ConnectWise suspended Cloud Backup and disabled seven application identities after compromised credentials enabled unauthorised access to customer Microsoft 365 environments. Attackers attempted privilege escalation and persistence by adding further application credentials. ConnectWise reported no evidence that isolated backup archives were breached, although affected backup and restoration services remained unavailable. Internet-facing security infrastructure also remains a significant target. Active exploitation affected BeyondTrust Remote Support, Ivanti Connect Secure, Cisco Secure Email Gateway and PAN-OS management interfaces. A separate intrusion involving Fortinet products at a telecommunications managed service provider exposed configurations and credentials associated with more than 500 managed firewalls Australian organisations were among those affected by the AOMEI Backupper update-infrastructure compromise. Malicious updates delivered backdoors during tampering windows between April and July, meaning endpoints previously infected require investigation even though the supplier's infrastructure has since been secured Australian retailer WAGD also remained offline after compromised Shopify extensions redirected customers towards fake checkout pages, although whether payment data was actually captured remains unconfirmed. --- **Vulnerabilities and Active Exploitation** Security and remote-access products continue to attract attackers precisely because of the privileged position they occupy inside enterprise environments. **BeyondTrust Remote Support CVE-2026-102764**, rated CVSS 9.3, is an authentication-bypass vulnerability exploited to steal credentials, deploy SAWFLY webshells and establish downstream access. Affected self-hosted versions require the BT26-05-RS patch, while hosted SaaS deployments have already been patched. **Ivanti Connect Secure CVE-2026-104935** was also exploited to obtain unauthenticated command execution. Attackers stole VPN credentials and targeted Active Directory passwords and BitLocker recovery keys while executing activity in memory, which may evade Ivanti's Integrity Checker Tool. Other significant vulnerabilities this week include: - **Cisco Secure Email Gateway CVE-2026-76519**, allowing unauthenticated file writes and potential root command execution. - **PAN-OS CVE-2026-0322**, exploited against management interfaces to achieve root-level code execution using valid credentials. - **Nextcloud CVE-2026-110447**, exploited to install webshells through its built-in Collabora component. - **SiteGuard CVE-2026-106931**, allowing commands to run as root or SYSTEM. - **Langflow CVE-2026-105740**, an authenticated MCP command-execution vulnerability under active attack. - **Windows Shell CVE-2026-96951**, an actively exploited flaw addressed by Microsoft's October security updatesCritical Drupal, Next.js and Adobe Commerce vulnerabilities also warrant attention, although the source reporting did not identify active exploitation of those particular flaws. **What organisations should prioritise** - Identify exposed remote-access and security appliances. - Apply the applicable vendor fixes and emergency updates. - Preserve forensic evidence where vendors warn remediation may remove traces. - Rotate credentials, certificates and API credentials where compromise is suspected. - Treat evidence of appliance compromise as more than a straightforward patching exercise. --- **Software Supply Chains Become an Identity Problem** This week's activity demonstrates that supply-chain attacks increasingly revolve around trusted credentials and identities rather than malicious software alone. The ConnectWise incident is a prime example. Compromised application credentials gave attackers access to customer Microsoft 365 tenants, potentially including email, Teams, SharePoint and OneDrive data. Disabling the affected applications does not necessarily invalidate previously issued tokens, making investigation of residual access important. Developer ecosystems were also targeted. The **GhostAction** campaign compromised approximately 1,900 GitHub accounts and targeted more than 30,000 repositories by inserting malicious GitHub Actions workflows designed to steal CI/CD secrets, cloud credentials, package-registry tokens and AI API keys. GitHub blocked later workflow execution, but credentials stolen earlier may remain usable. The malicious npm package **imgdecode** similarly targeted Windows development environments, installing information-stealing and remote-access malware capable of targeting browser sessions, messaging accounts and cryptocurrency recovery information. The practical takeaway is that development infrastructure should be treated as privileged infrastructure. A compromised GitHub, npm or CI/CD identity can provide access far beyond the developer's workstation. --- **Phishing and Identity Attacks Keep Evolving** Traditional phishing has not disappeared. It has simply become more sophisticated. Microsoft and industry partners disrupted the **Yam Store** phishing ecosystem, including the CoGUI, Haozi/Phoenix and Iron Man System phishing kits. The infrastructure supported more than one billion messages since January across more than 150 countries, including Australia, and was designed to capture credentials and verification codes while impersonating trusted organisations. Fake IT-support campaigns are another concern. Reporting in this week's intelligence identified attempts through Microsoft Teams involving spam floods followed by fake support interactions designed to convince users to install remote-access software. Device-code phishing campaigns were also observed enabling token reuse and rogue-device registration despite MFA protections. Fake Claude, ChatGPT, Copilot and Gemini installers added another layer to the problem, using advertising, shared content, ClickFix techniques and malicious terminal commands to distribute information stealers and remote-access Trojans. For businesses, user awareness should increasingly cover unexpected Teams support requests, device-code authentication, software installation prompts and AI-tool downloads, not just suspicious email attachments. --- **AI Security: Keep the Risk in Perspective** AI security continues to generate attention, but this week's intelligence also provides an important reminder not to overstate the threat. Researchers demonstrated that AI agents can accelerate offensive security research under controlled conditions, including helping develop a three-vulnerability Chrome sandbox-escape chain in six days. Separate laboratory testing reportedly compromised operational technology environments in 16 to 28 minutes. These were controlled demonstrations, not evidence of autonomous AI attacks operating at scale in the real world. Anthropic also patched the **SneakPeek** vulnerability affecting Claude Code Desktop after researchers bypassed an initial fix. Malicious repository HTML could execute automatically within the preview pane and expose developer credentials without additional user interaction. Research into self-replicating AI across poorly secured Android devices is similarly worth monitoring, but the intelligence explicitly notes that no complete autonomous AI worm has been observed. At the same time, Proofpoint found examples where attackers' AI-generated phishing and malware were defective, demonstrating that AI does not automatically translate into better attacks. The sensible response is governance rather than panic: tightly scoped agent identities, restricted network access, approved AI installation channels and human approval for consequential actions. --- **When Cyber Attacks Create Physical Consequences** One of the week's more striking developments came from attacks against supermarket refrigeration controllers in France. Attackers manipulated systems and, in some cases, reportedly raised temperatures to **50°C**, resulting in food losses and reported fires. The precise entry mechanism and broader European impact remain unresolved. Several known vulnerabilities affect relevant Danfoss AK-SM 800A equipment, including authentication bypass, command injection and denial-of-service flaws, but the source material does **not** confirm those vulnerabilities were responsible for these incidents. For Australian retailers and operators, this is a useful reminder that cyber security and physical operations increasingly overlap. Unsupported controllers, unnecessary internet exposure and poorly governed contractor access can create risks extending well beyond information loss.   **Final Thoughts** This week's threat intelligence is ultimately about **privilege without a person behind it**. Application identities can access Microsoft 365. Software updates can execute trusted code. CI/CD pipelines hold powerful credentials. Remote-access appliances sit at the edge of corporate networks. AI agents can act on behalf of users. Every one of these relationships creates trust, and increasingly, attackers are looking for ways to inherit that trust rather than defeat security controls directly. For Australian businesses, the priority should therefore extend beyond protecting employees. Organisations should understand which suppliers, applications, service principals, development pipelines and automated systems hold privileged access, then ensure those identities are monitored, restricted and removable when something goes wrong. **The next generation of identity security isn't just about proving who a user is. It's about controlling what every trusted identity, human or otherwise, is allowed to do.**   [Weekly Cyber Reports](https://digitalfrontierpartners.com.au/news/tag/weekly-cyber-reports) ###### Visit Us On: [linkedin-in icon](https://www.linkedin.com/company/digitalfrontierpartners/posts/?feedView=all) [Follow us on Facebook](https://www.youtube.com/watch?v=-BsUxioXzCk&t=6s) --- [![](https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp)](https://digitalfrontierpartners.com.au/) Level 4, 350 Collins St, Melbourne VIC, Australia 3000 +61 [1800 288 817](https://www.google.com/search?q=digital+frontier+partners&oq=digital+&gs_lcrp=EgZjaHJvbWUqDwgAECMYJxjjAhiABBiKBTIPCAAQIxgnGOMCGIAEGIoFMhUIARAuGCcYrwEYxwEYgAQYigUYjgUyBggCEEUYOTIMCAMQABhDGIAEGIoFMgwIBBAAGEMYgAQYigUyBggFEEUYPDIGCAYQRRg8MgYIBxBFGDzSAQg0MzQ1ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8#) Company   - [Home](https://digitalfrontierpartners.com.au/hp) - [About Us](https://digitalfrontierpartners.com.au/about) - [Careers](https://digitalfrontierpartners.zohorecruit.com.au/jobs/Careers) - [Contact Us](https://digitalfrontierpartners.com.au/contact) --- Resources - [News](https://digitalfrontierpartners.com.au/news) - [Research](https://digitalfrontierpartners.com.au/news) - [Weekly Cyber Report](https://digitalfrontierpartners.com.au/news) - [Case Studies](https://digitalfrontierpartners.com.au/news) --- Policies - [Privacy Policy](https://digitalfrontierpartners.com.au/news/privacy-policy) - [Information Security Policy](https://digitalfrontierpartners.com.au/news/information-security-policy) - [Quality Policy](https://digitalfrontierpartners.com.au/news/quality-policy) Products and Services - [Cybersecurity](https://digitalfrontierpartners.com.au/cybersecurity-services-24/7-threat-monitoring-and-response-dfp) - [Due Diligence](https://digitalfrontierpartners.com.au/technology-due-diligence-product-assessment-digital-frontier-partners) - [Enterprise Artificial Intelligence (AI)](https://digitalfrontierpartners.com.au/enterprise-ai) - [Technology Advisory](https://digitalfrontierpartners.com.au/technology-advisory-services-digital-frontier-partners) - [Workforce Optimisation](https://digitalfrontierpartners.com.au/workforce-optimisation-ai-driven-cost-control-and-performance-dfp) --- Industries - [Local Government](https://digitalfrontierpartners.com.au/localgovernment-cybersecurity) - [Financial Services Cyber Security](https://digitalfrontierpartners.com.au/financialservices) - [Financial Services Artificial Intelligence](https://digitalfrontierpartners.com.au/financial-services-artificial-intelligence) - [Mid Market Enterprise AI](https://digitalfrontierpartners.com.au/enterprise-artificial-intelligence) - [Aged Care Roster Optimisation](https://digitalfrontierpartners.com.au/aged-care-rostering-optimisation) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Digital Frontier Partners", "url" : "https://digitalfrontierpartners.com.au/news/author/digital-frontier-partners" }, "dateModified" : "2026-10-19T22:15:25.368Z", "datePublished" : "2026-10-19T22:15:25.000Z", "headline" : "Cyber Risk Is Moving Beyond the User", "image" : [ "https://digitalfrontierpartners.com.au/hubfs/AI-Generated%20Media/Images/Cybersecurity%20Team%20at%20Modern%20Office%20Conference.png" ], "mainEntityOfPage" : { "@id" : "https://digitalfrontierpartners.com.au/news/cyber-risk-is-moving-beyond-the-user", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://digitalfrontierpartners.com.au/hubfs/DFP-Logo.webp" } } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#organisation", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "AU", "addressLocality" : "Melbourne", "addressRegion" : "VIC", "postalCode" : "3000", "streetAddress" : "Level 4, 350 Collins Street" }, "description" : "Digital Frontier Partners provides enterprise technology advisory, AI enablement, workforce optimisation and cybersecurity services, helping organisations align strategy, value and risk.", "email" : "contact@digitalfrontierpartners.com", "knowsAbout" : [ "Enterprise AI enablement", "Artificial intelligence strategy", "AI governance and risk", "Workforce optimisation", "Cybersecurity", "Technology due diligence", "Digital transformation" ], "logo" : { "@type" : "ImageObject", "contentUrl" : "https://digitalfrontierpartners.com.au/hs-fs/hubfs/DFP-Logo.webp?width=1200&height=342&name=DFP-Logo.webp", "height" : 342, "width" : 1200 }, "name" : "Digital Frontier Partners", "telephone" : "+61 1800 288 817", "url" : "https://digitalfrontierpartners.com.au/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://digitalfrontierpartners.com.au/#website", "@type" : "WebSite", "inLanguage" : "en-AU", "name" : "Digital Frontier Partners", "publisher" : { "@id" : "https://digitalfrontierpartners.com.au/#organisation" }, "url" : "https://digitalfrontierpartners.com.au/" } ```