Threat Analysis: Brevo Supply Chain Attack and Clop's Return, What UK SMBs Need to Know
This is your Daily Threat Analysis for 18th September 2026.
Two campaigns landed this week that deserve your full attention. Both exploit the same structural weakness: your dependence on third-party platforms you cannot audit, patch, or monitor in real time. If your IT provider tells you neither of these applies to your business, ask them to prove it.
The Brevo Supply Chain Attack
On 14th September 2026, attackers compromised Brevo’s infrastructure and injected malicious code into the company’s JavaScript assets and widgets. Brevo is an email marketing and CRM platform with a substantial customer base. The research from Sansec identifies two distinct payloads delivered through this compromise.
The first payload targeted WordPress site administrators. When an admin visited their own site while logged in, a malicious WordPress plugin was automatically installed in the background. No prompt. No confirmation dialogue. The administrator would have seen nothing unusual.
The second payload delivered ClickFix overlays to regular site visitors. ClickFix is a social engineering technique that presents users with fake error messages or verification prompts, instructing them to paste and execute a command. The payload here was designed to capture credentials and potentially deliver further malware to visitors.
More than 100,000 customer websites are reported to have been in scope.
Let that number sit for a moment. This was not a targeted attack against a single organisation. It was a single point of compromise in a shared platform that cascaded outward to everyone who trusted it. The attackers did not need to find 100,000 vulnerabilities. They found one.
This is the supply chain threat model in its purest form. Your site may have had no vulnerabilities. Your WordPress installation may have been fully patched. None of that mattered, because the attack came through a script you loaded from someone else’s CDN.
What to check if you use Brevo
If your organisation uses Brevo, or if your web developer or agency does on your behalf, the following checks are not optional:
- Review your WordPress plugin list for any plugins you did not install or recognise, particularly those installed around 14th September 2026
- Check your site’s JavaScript loading for any external scripts that were not there before mid-September
- If you have server access logs, look for unusual plugin installation events in that window
- Contact your web developer or agency and ask them directly whether they use Brevo and whether they have audited affected sites
If your IT provider has not raised this with you already, that is information worth having.
Clop is Back, and the Tooling Has Improved
Clop is not a new name. The group has been running mass-exploitation campaigns since at least 2020, targeting file transfer software and enterprise platforms with a consistent methodology: find a zero-day or newly disclosed vulnerability, exploit it at scale before patches are applied, exfiltrate data, and demand payment.
The advisory from ReliaQuest confirms that Clop is now exploiting CVE-2026-12569 in PTC Windchill, a product lifecycle management platform used across manufacturing, engineering, and supply chain environments. The group has deployed a custom web shell purpose-built for data theft.
What distinguishes this implant is that it requires no additional tooling once deployed. It carries built-in credential harvesting, database enumeration, and what ReliaQuest describes as a custom Java component for exfiltration. The attackers land, steal, and move. Dwell time is compressed. Detection windows are short.
PTC Windchill is not consumer software. It is used by organisations that design and manufacture physical products, and it sits at the centre of their operational data. UK manufacturing and engineering firms, many of which are SMBs supplying into larger primes, should treat this as a direct concern.
If your business uses PTC Windchill, the patch for CVE-2026-12569 should already be applied. If you are not certain, find out today. If your MSP or IT provider manages that system for you, ask them to confirm patch status in writing.
The advisory does not say how many organisations have already been compromised. That omission is not accidental. In Clop’s previous campaigns, by the time a public advisory appeared, the exfiltration had already happened. The question was never whether to patch. The question was whether you patched before or after they arrived.
One to Watch: Settra Ransomware and RMM Abuse
A third item worth flagging for UK SMBs, though I will keep this brief. Huntress has published analysis of Settra, a ransomware variant first observed in June 2026 that has targeted consumer services, retail, and manufacturing sectors. The group’s entry points have been VPNs and compromised credentials.
What makes Settra notable is its use of MeshAgent, a legitimate remote monitoring and management tool, for persistence. This is a pattern that has become increasingly common across ransomware groups. Legitimate RMM tools are not flagged by most endpoint security products because they are, by design, trusted. If your business uses a managed service provider, your IT environment almost certainly has an RMM agent installed. That is not a problem in itself. The problem arises when attackers install their own RMM agent alongside yours, and neither your provider nor your endpoint tools notice.
Ask your MSP which RMM tools are authorised on your systems and how they would detect an unauthorised one.
The Wider Pattern
Three different campaigns, three different entry points, one common thread: the attack surface is not just your own systems. It is every platform, script, credential, and tool that touches your environment.
The NCSC has published guidance on supply chain security. The NCSC has also published guidance on ransomware, on secure configuration, and on monitoring. The Brevo campaign compromising over 100,000 sites in September 2026 tells you something about how consistently that guidance is being applied.
None of this requires sophisticated security operations. It requires asking the right questions of the people who manage your technology, and insisting on straight answers.
Actions for Today
- Brevo users: Audit WordPress plugins and external JavaScript on your site. Check for anything installed or modified around 14th September 2026.
- PTC Windchill users: Confirm that CVE-2026-12569 has been patched. Get written confirmation from your IT provider if they manage the system.
- All SMBs: Ask your MSP which RMM tools are authorised on your systems and how unauthorised installs would be detected.
- All SMBs: Review what third-party scripts load on your public-facing website. If you do not have a list, that is the first problem to solve.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up.
Sources
| Source | Title | URL |
|---|---|---|
| Sansec | Brevo supply chain attack hits 100k+ sites with WordPress backdoors and ClickFix malware | http://sansec.io/research/brevo-supply-chain-attack |
| ReliaQuest | Clop Returns with Custom Implant in Mass-Extortion Campaign | https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign |
| Huntress | New Settra Ransomware Variant Deploys MeshAgent RMM | https://www.huntress.com/blog/new-settra-ransomware-variant |
| BleepingComputer | New Check Point flaw lets hackers execute code with root privileges | https://www.bleepingcomputer.com/news/security/check-point-warns-critical-flaw-lets-hackers-execute-code-as-root/ |
| Zscaler | C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2 | https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2 |