Article
Top Tips to Improve Cybersecurity Today
Arete Analysis
By Kevin Baker
When I work with clients, I mention a good many things they can do to improve their security. Sometimes I’ll advise on an area I think they need to understand about their company. Sometimes I’ll suggest implementing specific security controls. Some things I propose are very important; others are “nice to haves.” And while my recommendations may change based on the attributes of the client company and the skill level of those involved in fighting the good fight, there are always six things I tell every client.
1: Clean up accounts
Clean up the accounts in your Windows domain by eliminating every account that doesn’t have a valid business purpose — and that includes both human identity and service (aka machine identity) accounts. Software on your servers uses service accounts to perform a specific function, often with a high level of privilege.
“Stale” accounts create unneeded risk and only up the chances of attackers succeeding in their mission. If you don’t understand why an account exists, either justify its existence or carefully remove it.
2: Ditch unnecessary data
Understand what sensitive data is for your company and locate every instance of what you deem sensitive across both your corporate and cloud environments. Most companies think they know where sensitive data is because they’ve asked the subject matter experts (SMEs). Nothing against SMEs, but the best practice is to examine and verify the file stores and network.
Rarely have I seen assumed inventory be accurate. What we think we have is usually orders of magnitude less than what is ultimately discovered.
As with stale accounts, stale data and unneeded or unknown copies of data create big risk. When a breach happens, the accumulation of stale data across file servers, public drives, and email clients will only make a bad day that much worse. So, if you don’t need it, get rid of it.
3: Use multifactor authentication
Passwords are no longer enough to guarantee protection and should be considered table stakes. Why? Because billions of passwords have been lost in breaches of high-profile companies, and people are prone to re-using passwords. A lost password in one place usually exposes multiple accounts and locations.
What’s more, supercomputing and artificial intelligence (AI) can eventually crack nearly every password. For this reason, multifactor authentication (MFA) is one of the best ways to protect your identity, your data, and your reputation. It’s well worth the time, effort, and expense to use MFA.
4. Make cybersecurity everyone’s responsibility
Step one in building an information security training program: Set expectations. Companies need to be clear with regards to employee responsibility around use of company systems and data. Though words cannot protect us directly, policies, standards, and guidelines are useful in setting a standard of due care that employees can clearly understand.
While there are many good security-awareness programs and resources available that teach social-engineering resistance and good security practices, they may not be worth the time or investment without a clear mandate from the company stating expectations of behavior and technical conditions.
Set a simple, but powerful policy: “Every employee is responsible for protecting the data entrusted to our company.”
5. Write an incident response plan
It’s an oft repeated phrase because it’s true: Breaches are not a matter of if, but when. So, don’t wait until it’s too late. Write an incident response plan now and don’t be caught flat-footed at a most critical moment.
And remember, security is not solely a technology problem, it’s also a business problem. IT plays a big role and may drive most of the actions during a breach, but they cannot effectively handle response alone. Everyone in the company is a stakeholder and every department should have a representative on the incident response (IR) team. Thus, make sure your plan assigns specific people to respond, including IT, management, and business representatives.
Inter-departmental communication is key to a swift response and should be part of what you practice. For example, who will talk to the news crews out front? Be sure to media-train personnel or have a crisis communication firm on speed dial. In fact, be sure to have all key contacts listed in your IR plan, including those for all related services or vendors. And regardless of how many venders you use, be sure to have clarity on the internal team as to who will coordinate the response and look after your company’s best interests.
Once you write your plan, practice it — again and again. You’ll improve every time, building muscle memory for fast detection and fast reaction to events that help ensure your success, not the bad guy’s. At a minimum, a good response will greatly minimize an event’s impact and, even if not wholly prevented, still add up to thousands of dollars saved.
6. Have a solid backup plan
Make sure you have a solid back up plan that includes offline copies.
Ransomware is a modern plague that’s costing the United States trillions of dollars per year. That money is going to fund organized crime, human trafficking, and terrorism. The bad actors will not stop what they are doing, and they will get around to you eventually.
As technology advanced, the use of backup tapes fell off, replaced by backups made to storage systems, the cloud, or both. If those online copies are protected by a Windows domain password, you will probably lose them. The first thing the threat actors will do is crack all the admin passwords and log into wherever you store those backups and encrypt them. Next, they’ll encrypt your endpoints, laptops and servers, and send a ransom note.
Expect to be attacked and prepare for it, not only by backing up your data, but also by having at least one offline copy of every critical system. An offline copy that cannot be accessed from any network will ensure that even if you are faced with a massive cleanup of encrypted systems, you’ll avoid having to pay a ransom.
Ransoms often cost hundreds of thousands of dollars, and may even run into the millions, so the cost of a solid disaster recovery plan, including offline copies, is peanuts by comparison.
Don’t make it easy on the bad guy
Like water, cybercriminals often take the path of least resistance. So, move, morph, and make your company a harder target to hit.
Want to see an immediate impact? Implement MFA. Want to harden your security over time? Find out and continue to track where your crown jewels reside.
These six steps are all within reach of every company. Start today, and get it done.
Back to Blog Posts
Article
Critical MOVEit Automation Vulnerabilities Disclosed
A security advisory released by Progress Software details critical and high-severity vulnerabilities affecting their MOVEit Automation managed file transfer (MFT) solution. The vulnerabilities, tracked as CVE-2026-4670 and CVE-2026-5174, could allow a threat actor to bypass authentication and escalate privileges, leading to unauthorized access, administrative control, and data exposure. Cybercriminals have leveraged several MFT tools in previous campaigns, including the Accellion File Transfer Application (FTA), Fortra GoAnywhere MFT, and Cleo MFT. Flaws in MFT software are highly targeted by cybercriminals due to the volume and sensitivity of the data they control.
What’s Notable and Unique
MOVEit Transfer was heavily exploited by the Cl0p ransomware group in the summer of 2023. While the window of exploit activity lasted only a few weeks, victim extortion and data leaks continued throughout the remainder of the year, leading to more than 70 class-action lawsuits filed in the U.S.
There is no workaround or hotfix for these vulnerabilities. To fully patch the flaws, MOVEit administrators need to perform a "full install" of the latest version, which will require taking the system offline.
Security researchers have discovered ~1,400 MOVEit Automation instances exposed to the internet, with dozens belonging to U.S. local and state government agencies.
Analyst Comments
While the vulnerabilities patched in Progress Software's recent release differ from the SQL injection vulnerability exploited by the Cl0p ransomware group in 2023, exploitation of CVE-2026-4670 and CVE-2026-5174 could lead to equally impactful outcomes. Beyond the immediate impacts on affected organizations, trusted data-exchange platforms provide threat actors with an avenue to obtain sensitive information and infect partner and supplier environments. Furthermore, Arete has seen the time window between disclosure and weaponization of critical vulnerabilities continue to shrink, especially as threat actors increasingly adopt AI-enabled tooling. As such, organizations should not only implement the patches released by Progress Software, but also hunt for typical post-compromise behavior like enumeration of the underlying database, the creation of new user accounts or users operating with unexpected administrator privileges, and the presence of unauthorized remote monitoring and management (RMM) tools.
Sources
MOVEit Automation Critical Security Alert Bulletin – April 2026 – (CVE-2026-4670, CVE-2026-5174)
From Breach to Courtroom: Inside the MOVEit Exploitation and Mass Litigation
Progress warns of critical MOVEit Automation auth bypass flaw
Article
Ransomware Trends & Data Insights: April 2026
The threat landscape has remained relatively predictable thus far in 2026. In April, Qilin dethroned Akira as the most active threat group for the month. Akira, who had been the top ransomware threat each month since July 2025, was still only slightly behind Qilin and had roughly the same activity level as in March. INC Ransom and DragonForce also remained active threats in April, with those four ransomware groups accounting for half of all ransomware and extortion activity observed by Arete.
Figure 1. Activity from the top 3 threat groups in April 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
Multiple ransomware operations continue to leverage the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Qilin has recently been observed leveraging a malicious file loaded via DLL side-loading along with vulnerable drivers, including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Arete observed Akira using the same vulnerable drivers in multiple engagements dating back to Q3 2025.
DragonForce has leveraged several of the same tools in recent engagements, including the remote desktop application Remotely Agent and the PoisonX.sys vulnerable driver. Additionally, open-source reporting indicates that the group recently used a Python-based backdoor known as VIPERTUNNEL to maintain reliable operator access and evade detection. DragonForce was responsible for over 7% of Arete ransomware engagements in April, and Arete notes increased activity from the group this year compared to 2025.
A social engineering tactic has reemerged in recent months in which threat actors impersonate IT and helpdesk staff via Microsoft Teams to contact employees and attempt to convince them to install remote access tools like Quick Assist, giving the threat actors remote access to the victim’s environment. This tactic was initially observed in late 2024 and early 2025 and was linked to now-defunct groups like Black Basta and Cactus, but has more recently been observed in intrusions linked to the Akira and Payouts King ransomware groups.
Sources
Arete Internal
Article
Payouts King Utilizes QEMU Emulator to Bypass EDR
Researchers recently identified threat actor campaigns leveraging QEMU, a free open-source virtual machine (VM) emulator, to evade endpoint security solutions. Since QEMU acts as a VM within the target environment, endpoint detection tools cannot scan inside the emulator or detect any malicious files or payloads QEMU contains. Although threat actors have been utilizing QEMU maliciously since 2020, recent activity is attributed to the Payouts King ransomware group and a cluster of threat actors believed to be initial access brokers who have also been exploiting the CitrixBleed2 vulnerability CVE-2025-5777.
What’s Notable and Unique
Payouts King has been observed deploying QEMU since November and uses the VM to create a reverse SSH backdoor to evade detection and install various tools, including Rclone, Chisel, and BusyBox.
In a separate campaign, threat actors are exploiting CVE-2025-5777, a Citrix NetScaler vulnerability that allows attackers to bypass authentication. Once they’ve gained initial access, the threat actors use QEMU to deploy tools inside the VM, which are then used to steal credentials, identify Kerberos usernames, perform Active Directory reconnaissance, and set up FTP servers for staging or data exfiltration.
Analyst Comments
Threat actors continue to focus their efforts on defense evasion, often leveraging legitimate, easily accessible tools such as QEMU. The continued use of QEMU by multiple threat actors highlights the effectiveness of these tactics and the difficulty in detecting and defending against them. To counter this campaign, organizations should proactively monitor for unauthorized QEMU installations, abnormal scheduled tasks, and port forwarding rules.
Sources
QEMU abused to evade detection and enable ransomware delivery
Article
Microsoft Teams Continues to be Leveraged in Social Engineering Attacks
Microsoft warns that threat actors are increasingly abusing Microsoft Teams and relying on legitimate tools to gain access and conduct lateral movement within enterprise networks. The threat actors impersonate IT or helpdesk staff to contact employees via cross-tenant chats and trick them into granting remote access for data theft. Microsoft has observed multiple intrusions with a similar attack chain that utilized commercial remote management software, like Quick Assist and the Rclone utility, to transfer files to an external cloud storage service. This tactic, notably associated with Black Basta and Cactus ransomware operations in late 2024 and early 2025, appears to have resurfaced, with similar activity more recently observed in intrusions linked to the Akira and Payouts King ransomware groups.
What’s Notable and Unique
Initial access is achieved by leveraging external collaboration features in Microsoft Teams to allow impersonation of internal support personnel, tricking users into bypassing security warnings. This reflects abuse of legitimate functionality rather than exploitation of a Microsoft Teams vulnerability.
Following initial access, attackers conduct rapid reconnaissance using Command Prompt and PowerShell to assess privileges, domain membership, and opportunities for lateral movement. Persistence is maintained through Windows Registry modifications, after which attackers leveraged WinRM for lateral movement, targeting domain-joined systems and high-value assets, including domain controllers.
Malicious payloads were staged in user-writable directories and executed through DLL side-loading via trusted, signed applications, enabling covert code execution while blending with legitimate activity. Additional remote management tools were also deployed to support broader access, while Rclone or similar utilities were used to stage and exfiltrate sensitive data to external cloud storage.
Analyst Comments
This activity highlights how modern threat actors can leverage trusted collaboration workflows, remote management tools, and stealthy exfiltration techniques to conduct intrusions through a combination of social engineering and misuse of legitimate functionality. Effective defense depends on layered mitigations that combine identity controls, restricted remote administration, endpoint hardening, network protections, and user awareness measures to disrupt attacker activity at multiple stages of the intrusion lifecycle. To mitigate the risk of this and similar campaigns, users should treat external Teams contacts as untrusted by default, and administrators should restrict or closely monitor remote assistance tools while limiting WinRM usage to controlled systems.
Sources
Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
Microsoft: Teams increasingly abused in helpdesk impersonation attacks
Payouts King Takes Aim at the Ransomware Throne