Threat Analysis: CoGUI Phishing Takedown and Ivanti Zero-Day, What UK SMBs Need to Know Today
This is your Daily Threat Analysis for the 14th of October 2026.
Two items today. Both matter. One is a win, with significant caveats. The other is active exploitation of a product that sits in a lot of UK remote access stacks, and the window for comfortable inaction closed two weeks ago.
The CoGUI Takedown: What It Is, and What the Headlines Are Leaving Out
Law enforcement agencies and Microsoft’s Digital Crimes Unit announced today the disruption of a large-scale criminal ecosystem responsible for more than a billion malicious messages targeting over 75,000 organisations across 150 countries. Microsoft tracks the phishing kit operation as Storm-2990 and the underlying illicit marketplace as Storm-3119. The broader operation has been widely referred to as CoGUI.
The infrastructure has been disrupted. Domain seizures, server takedowns, coordinated action across jurisdictions. By the metrics of law enforcement announcements, this is a significant result.
Here is what the announcement does not say.
The operators are not in custody. Disruption and dismantlement are not the same thing. Criminal ecosystems of this scale are built on distributed infrastructure, redundant tooling, and, critically, a separation between the infrastructure operators and the individuals running individual phishing campaigns. You can seize the kit marketplace. The buyers still exist. The techniques still work.
The CoGUI playbook was not unusual, it was effective at volume. Microsoft’s analysis describes an interconnected network selling phishing kits and infrastructure as a service. This is the industrialisation of credential theft. The lures, the methods, the underlying approach, none of that evaporates when a C2 network goes dark. Actors with access to the kit methodology will rebuild on new infrastructure. They have done it before.
The targets were not exotic. Over 75,000 organisations. The CoGUI ecosystem did not restrict itself to enterprise targets or specific sectors. Scale-oriented phishing operations monetise volume. A small professional services firm in Manchester is as viable a target as a FTSE 250 company, because the credentials of a small firm’s staff are worth money, the firm’s banking access is worth money, and smaller organisations have weaker detection.
For UK SMBs, the practical read is this: the specific infrastructure is down, but the threat class it represents, industrialised credential phishing at scale, is not. Your email filtering configuration, your staff’s ability to recognise credential-harvesting lures, and your controls around what happens when credentials are compromised remain as relevant today as they were yesterday.
What a CoGUI-style Lure Looks Like
Based on the Microsoft and BleepingComputer reporting, CoGUI-linked campaigns used convincing domain impersonation, legitimate-looking login pages, and in some cases CAPTCHA mechanisms to add credibility. The goal was credential capture, getting a victim to enter their username and password on a page they believed was real.
This is not a novel technique. The NCSC has published guidance on phishing-resistant authentication for years. The fact that an operation sending a billion messages found credential phishing sufficiently productive to sustain that volume tells you everything about how seriously organisations have taken that guidance in aggregate.
The specific thing to watch for in the coming weeks: as the CoGUI network rebuilds, and some element of it will, expect lures to evolve. Campaigns that target VPN login pages, Microsoft 365 portals, and banking interfaces tend to follow infrastructure disruptions, as operators test what still works.
There is a separate but related item in today’s intelligence that is worth noting alongside CoGUI: Huntress has documented a credential phishing campaign specifically targeting WatchGuard Mobile VPN users through a fake download site at watchguard-vpn[.]net. The attack used SEO poisoning to surface the fraudulent site in search results, then collected victim credentials twice through browser pop-ups before delivering the genuine, validly signed WatchGuard installer, the real software, from the real vendor, to avoid raising suspicion. This is a different threat actor and a different technique, but the target is the same: VPN credentials. If your staff search for VPN client software rather than navigating directly to a bookmarked vendor page, that is a risk vector worth closing.
Ivanti Connect Secure Zero-Day: Actively Exploited, Patched, and You Still Need to Check
CISA has added a vulnerability in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalogue, with a directive for federal agencies to patch immediately. The exploitation of this vulnerability has been confirmed as active since at least the 1st of October 2026.
CISA’s KEV catalogue is not speculative. Inclusion means confirmed active exploitation in the wild. The directive to federal agencies carries a fixed remediation deadline; for everyone else, ‘immediately’ is the operative word.
Ivanti Connect Secure is a widely deployed SSL VPN product. It sits at the network perimeter, specifically, it is the thing that lets remote workers connect to internal systems. Vulnerabilities in this product class are attractive to threat actors because a compromised VPN gateway provides authenticated access to internal networks without needing to bypass endpoint controls. You are not fighting your way through the perimeter; you are walking in through the front door with a valid key.
This is not Ivanti’s first rodeo on this front. Multiple high-severity vulnerabilities in Ivanti Connect Secure have been exploited in previous years, including incidents that resulted in mass exploitation of unpatched devices before patches were applied. The pattern is consistent: vulnerability disclosed, exploitation begins, organisations that have not patched become entry points.
What the advisory does not say explicitly, but what the timeline makes clear: if your Ivanti Connect Secure deployment has not been patched and exploitation has been confirmed since the 1st of October, you have had two weeks of active exposure. The question is not whether to patch. The question is whether you are already compromised.
The Supply Chain Angle
For UK SMBs who do not operate Ivanti infrastructure directly: your managed service provider might. If your IT provider manages your remote access infrastructure, you need a direct answer to a direct question: is our Ivanti Connect Secure deployment patched against the vulnerability added to the CISA KEV catalogue on the 14th of October 2026?
If your provider cannot answer that question promptly, that is information you need.
If your provider tells you this does not affect you because you are too small, ask them how many of the organisations affected by previous mass-exploitation events thought they were too small to be worth targeting. Ivanti exploitation is not targeted. It is opportunistic and automated at scale.
Immediate Steps
If you run Ivanti Connect Secure:
- Identify whether your deployment has received the relevant patch. Check with your IT team or provider today, not at the next scheduled review.
- Review logs for indicators of compromise going back to at least the 1st of October. Exploitation preceded the public CISA advisory; if you were unpatched during that window, treat it as a potential incident until you can confirm otherwise.
- Consider whether temporary access restrictions are appropriate while you verify patch status and review logs.
If you do not know what VPN product you use for remote access, that is a different problem, but it starts with the same question to your IT provider.
Hirudo: One to Watch on Android
A secondary item worth flagging for completeness. Researchers have documented a new Android malware called Hirudo that steals bank account credentials by replacing legitimate banking applications with modified versions that disable the security checks those apps normally perform. The modified apps look like the real thing. They do not behave like the real thing.
The immediate SMB relevance is lower than the two lead items, but it is not zero. Business banking is increasingly done on mobile devices. Staff using personal Android devices for any aspect of business financial management carry this risk into the business. The mitigation is straightforward: only install banking applications from official app stores, verify you are installing from the genuine developer, and be sceptical of any prompt to update or reinstall a banking app from outside official channels.
Summary: What Today’s Threat Picture Tells You
The CoGUI disruption is genuinely good news, and credit where it is due to the law enforcement and private sector cooperation that made it happen. But a takedown is not a cure. The techniques work, the criminal ecosystem will reconstitute elements of itself, and credential phishing at volume remains one of the most productive attack methods available.
The Ivanti zero-day is not good news, and the caveats are few. Active exploitation confirmed. Two weeks of potential exposure before the public advisory. If you have Ivanti in your stack, this is today’s priority.
The fake WatchGuard VPN site is a reminder that even users doing the right thing, downloading legitimate software, can be intercepted if they end up on the wrong site first. SEO poisoning is effective precisely because it targets people with genuine intent.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone in your network who needs the heads-up. The information is only useful if it reaches the people who can act on it.
Sources
| Source | Title | Link |
|---|---|---|
| Microsoft Security Blog | The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Read |
| BleepingComputer | Global takedown hits network behind 1 billion phishing messages | Read |
| BleepingComputer | CISA warns admins to immediately fix Ivanti flaw exploited as zero-day | Read |
| Huntress | Clean Install, Stolen Creds: Fake WatchGuard VPN Site Serves Genuine Signed Client | Read |
| BleepingComputer | Hirudo Android malware replaces banking apps to evade security checks | Read |