APT29 Watering Holes & Zyxel Zero-Day UK SMB Nov 2026 | SBCSG

This is your Daily Threat Analysis for the 5th of November 2026.

Three items today. All three have direct exposure for UK SMBs. I will take them in order of the breadth of potential impact.

APT29 Is Running Mobile Watering Holes, and One of the Lures Was a UK Hotel Site

Sekoia’s Threat Detection and Research team published analysis today of a campaign they have attributed to APT29, the Russian Foreign Intelligence Service-linked group, targeting mobile devices through watering hole attacks. This is not a theoretical campaign. It is active, documented, and one of the impersonated sites was a luxury UK hotel website located near sensitive government institutions, reportedly visited by Ukrainian President Zelenskyy.

Let me be precise about what that means operationally. This is not a phishing email. The victim visits what appears to be a legitimate website, a hotel, a cultural institution, and the injected JavaScript profiles their browser and device before silently delivering platform-specific exploit chains. iOS or Android, the attack selects the appropriate payload. No suspicious link to click, no attachment to open.

The advisory attributes three infection vectors to this campaign: compromised legitimate websites, adversary-in-the-middle-style impersonation of high-profile domains, and supply-chain compromise of a Ukrainian analytics service called Plerdy. The CVEs involved span iOS and Android, including CVE-2024-27808, CVE-2024-27833, CVE-2024-27834, CVE-2025-14174, CVE-2025-24201, CVE-2025-27038, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700, and CVE-2026-3910. These are n-day exploits, meaning they target vulnerabilities for which patches exist, but which a substantial proportion of devices in the field are not running.

What the reporting does not say loudly enough is what this means for UK businesses. The advisory frames this as diplomatic and government targeting. That framing is correct for the primary targets. But it describes a campaign where the delivery mechanism was a UK hospitality website. Any employee who visited that site on a corporate or personal mobile device during the period it was compromised was a potential victim. You do not have to be a diplomat. You have to be a person who looked up a hotel.

The implications for businesses with bring-your-own-device policies, or staff who travel and use mobile devices for work email and applications, are worth taking seriously. If those devices are not receiving timely operating system updates, they carry the same vulnerability surface as the intended targets.

What to do:

Confirm that all corporate mobile devices are enrolled in a mobile device management solution and are receiving OS updates promptly. The exploits used in this campaign target patched vulnerabilities. If your devices are patched, the documented attack chain does not apply.
If you operate a BYOD policy, establish a minimum OS version requirement for devices accessing corporate systems. Enforce it.
Review whether your staff have access to work email, files, or applications through personal devices that may not be receiving updates. That is a gap worth quantifying.
If you use web content filtering on corporate networks, consider whether it extends to mobile device traffic.

Zyxel GS1900 Zero-Day: Nearly 1,000 Network Switches Compromised

Zyxel has patched a zero-day vulnerability in its GS1900 series managed network switches, CVE-2026-107441 and CVE-2026-7273, that attackers exploited before the fix was available. According to BleepingComputer’s reporting, nearly 1,000 devices worldwide were compromised. The attackers stole configuration files and credentials.

This matters to UK SMBs directly. The GS1900 series is a managed switch product aimed squarely at the small and medium business market. It is exactly the kind of kit that sits in an SMB server room, managed by an IT provider or a part-time IT person, and rarely updated because it is not front of mind. Network infrastructure tends to be installed and forgotten until it breaks or causes a problem.

When configuration files are stolen from a network switch, the attacker obtains a detailed map of your network, VLANs, port assignments, management credentials, potentially credentials for connected systems. That is reconnaissance data for a later, more damaging attack. It is also potentially access to the switch management interface itself.

What the patching advisory does not say explicitly: if your device was already compromised before you apply the patch, patching does not evict the attacker. It closes the initial entry point. If credentials were harvested before you patch, those credentials remain valid elsewhere unless you change them.

What to do:

Check whether you have Zyxel GS1900 series switches in your environment. Ask your IT provider if you are unsure.
Apply the available firmware update from Zyxel immediately.
After patching, rotate all credentials stored on or associated with those switches. This includes management passwords and any credentials that may have been accessible through harvested configuration files.
Review switch management access logs if available. Look for unexpected access, particularly from unfamiliar IP addresses.
If you use an IT managed service provider, ask them to confirm patch status across all network infrastructure in your environment, not just this specific device.

This is the second significant network infrastructure zero-day this month that has seen active exploitation before patches were available. If your network devices are not part of a regular patching cycle, that gap needs addressing as a matter of priority, not convenience.

SkyW4lker: The Phishing Kit That Bypasses MFA Without Stealing Your Password

ANY.RUN has published analysis of SkyW4lker, an active phishing kit targeting Microsoft 365 users. It has been active between at least June and October 2026. During that period, researchers identified 618 sandbox analyses of related activity, with submissions increasing over time. It is operating in Europe.

I want to be direct about why this matters, because the temptation will be to file it under “phishing” and move on.

SkyW4lker does not steal your password. It does not intercept your MFA code. It abuses Microsoft’s legitimate device-code authentication flow, a mechanism that exists to allow authentication on devices that cannot display a full browser login page, such as smart TVs or printers. The attack presents the victim with a legitimate Microsoft device code, instructs them to enter it at a real Microsoft URL, and when the victim completes that step, the attacker receives a fully authenticated session token for the account.

The NCSC published guidance on token theft and MFA bypass techniques. The fact that device-code phishing is still generating hundreds of sandbox analyses suggests the guidance has not translated into defensive action at sufficient scale.

From the attacker’s perspective, this is attractive because it produces authenticated access to the Microsoft 365 account, including email, SharePoint, OneDrive, and any other connected service, without triggering the credential-based alerts that traditional phishing would generate. The session token is valid. It looks like a legitimate login.

For UK SMBs running Microsoft 365, which is most of them, this is the attack that defeats the MFA control you put in place and correctly feel good about. It is not a failure of MFA as a concept. It is a failure to restrict the authentication methods that are permitted for your tenant.

What to do:

If you administer a Microsoft 365 tenant, review whether device code flow authentication is enabled and whether it needs to be. For most SMBs, it does not. Microsoft provides conditional access policies that can restrict or block device code flow for users who do not require it.
If you are using Microsoft Entra ID (formerly Azure Active Directory), Conditional Access policies can be configured to block device code flow authentication for standard users. This is not a complicated change, but it requires someone with admin access to implement it.
If you are on a Microsoft 365 Business Basic or similar plan that does not include full Conditional Access, consider whether upgrading to a plan that does is worth the cost. The answer, for most businesses, is yes.
Train staff to be sceptical of any request to enter a code at a Microsoft website, particularly if prompted outside of a normal sign-in flow or by an unexpected message.
Ask your IT provider whether device code flow is currently restricted in your tenant. If they cannot answer the question immediately, that is worth noting.

A Note on the Wider Picture Today

There is a significant amount of AI-related threat activity in today’s intelligence. The ARTEX autonomous penetration testing framework is being used by VAPOR PANDA, a China-nexus actor, against over 200 organisations globally including targets in Europe. The Binance heist, $6.34 billion attributed to North Korea’s TraderTraitor operation, is a signal about the operational maturity of state-sponsored financial crime. Neither of these has immediate, direct action implications for UK SMBs today, but both are worth monitoring. AI-driven attack automation is not a future concern. It is current operational tradecraft for well-resourced threat actors.

The XLoader business email campaign described by Morphisec is worth flagging briefly: order confirmation or payment request emails containing RAR archives are delivering a multi-stage payload that includes in-memory execution to evade detection. If your staff receive order confirmations or payment requests by email, and in most businesses they do, that is a live lure type in circulation right now. The right control is not telling staff to be careful. It is blocking RAR file attachments at the email gateway if you have no business requirement to receive them, and ensuring endpoint protection is capable of detecting in-memory execution.

If the Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and if someone in your network needs the heads-up on what is actually moving today, pass it along. The GTA VI phishing campaign in today’s intelligence is a reasonable reminder that consumer-facing threats have a habit of arriving in business inboxes by the end of the week.

Sources

Source	Title	URL
Sekoia TDR	Poisoned Source: APT29 Watering Holes Targets Mobile Devices	https://www.sekoia.com/blog/poisoned-source-apt29-watering-holes-targets-mobile-devices-with-n-day-exploits
BleepingComputer	Zyxel fixes zero-day exploited to hack nearly 1,000 network switches	https://www.bleepingcomputer.com/news/security/zyxel-fixes-zero-day-exploited-to-hack-nearly-1-000-network-switches/
ANY.RUN	SkyW4lker Phishing Kit: Microsoft 365 Threat	https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/?utm_source=csn&utm_medium=article&utm_campaign=skyw4lker&utm_content=blog&utm_term=041126
Ars Technica	Hackers exploited iOS and Android flaws to infect phones	https://arstechnica.com/security/2026/11/hackers-exploited-ios-and-android-flaws-to-infect-phones/
Morphisec	From Business Emails to XLoader: An Order Lure That Led to In-Memory Injection	https://www.morphisec.com/blog/from-business-emails-to-xloader-an-order-lure-that-led-to-in-memory-injection