UK Cyber Threat Analysis 9 Jul 2026 | SBCSG | The Small Business Cybersecurity Guy

Hello, Mauven here.

This is your Daily Threat Analysis for 9th July 2026.

Three items today. One is a patch that should have arrived weeks ago. One is an infostealer campaign that has quietly moved from phishing emails into developer toolchains. And one is a policy update from the NCSC that is being underreported because it does not involve an incident, but which matters practically for smaller organisations thinking about certification.

The RoguePlanet Zero-Day: Microsoft Ships a Fix, Weeks Late

Microsoft has today issued a patch for the RoguePlanet zero-day in Windows Defender, attributed to the threat actor tracked as Nightmare Eclipse. According to The Register’s reporting, exploit code for this vulnerability has been publicly available for some weeks. Redmond has now closed the book on it.

Let me be direct about what that timeline means. A zero-day in your endpoint protection tool, the software specifically responsible for detecting and blocking threats, was sitting unpatched while working exploit code circulated publicly. Any attacker with moderate capability could have used it. Some probably did.

The patch is now available. For organisations where Microsoft Defender updates automatically as part of Windows Update, this should propagate without manual intervention. The question you need to answer today is whether your endpoint protection is actually set to auto-update, and whether that update mechanism has been functioning correctly. Many SMBs assume it has. Not all of them are right.

If your IT provider manages endpoint protection on your behalf, ask them to confirm the patch has been applied. Not next week. Today.

The broader point here is attribution and response speed. The advisory names Nightmare Eclipse. What it does not tell you is what other TTPs this actor uses, what sectors they have historically targeted, or whether their campaign continued while the patch was delayed. That context matters if you are trying to assess your exposure during the gap period. If you experienced any anomalous Defender behaviour in the last several weeks, unexpected quarantine actions, performance changes, or alerts that resolved without apparent cause, that is worth a second look.

Vidar Infostealer: It Has Left the Phishing Lane

Vidar is not new. It has been operating as Malware-as-a-Service since 2018. What is notable in the current reporting, across AhnLab ASEC, Palo Alto Unit 42, and Socket’s research, is how the delivery mechanism has evolved.

The earlier pattern was relatively familiar: phishing emails disguised as job applications or copyright notices, with attachments that appeared to be Word documents but were executables. That campaign has been running against targets in South Korea through the first half of 2026, using a Go-based packer and dead drop resolvers on Discord to retrieve command-and-control configuration. Vidar collects browser credentials, cryptocurrency wallets, and session tokens. It then exfiltrates.

The Unit 42 reporting adds another delivery vector: malvertising. Attackers are distributing password-protected archives that impersonate cracked software, using Go-compiled loaders that include rogue Authenticode certificates, meaning they can appear to be legitimately signed. The same campaign also drops XMRig, a cryptocurrency miner, which tells you something about the financial motivation and the willingness to extract value by multiple means from the same compromised host.

But the item that should concern UK SMBs most, particularly those with any software development capability or who use open-source tooling, is the Socket research into what they are tracking as Operation Muck and Load.

A malicious Go module, posing as a DNS and subdomain scanner, was found to be the entry point into a staging infrastructure comprising 222 confirmed repositories across 190 GitHub accounts. These repositories were designed to appear active and legitimate. They were used to stage AsyncRAT, Vidar, and Quasar RAT. The technique involved commit farming, generating artificial activity to make repositories look maintained and credible, combined with dead drops and protected archives to deliver the final payload.

This is supply chain compromise targeting developers directly. If someone on your team pulled a Go module from GitHub without verifying it, they may have introduced this. The same principle applies to npm and PyPI packages: Socket also identified 17 malicious packages published simultaneously on 7th July targeting PaySafe, Skrill, and Neteller payment SDK names, designed to steal developer credentials and tokens.

The advisory from Socket does not say that UK businesses were targeted. What I will say is that developers in professional services firms, fintech, and any business that handles payment integrations are exactly the kind of downstream target this infrastructure is designed to reach. The repositories were built to look credible. That is the point.

What to do about this:

If your team uses Go modules, npm packages, or PyPI packages, implement a verification step before any new dependency is introduced. Check publication date, contributor history, download volume relative to claimed purpose, and whether the package name is a plausible typosquat of something legitimate.
If you use a software composition analysis tool, ensure it is scanning for these specific package families.
If you do not have any of that in place and you have developers using open-source tooling, that is a risk item that belongs on your next IT review agenda.

NCSC Cyber Essentials Pathways: What the Blog Does Not Say Out Loud

The NCSC published a blog post today on what they are calling Cyber Essentials Pathways, an alternate route to Cyber Essentials Plus certification, described as moving from proof of concept to cyber confidence without compromising the scheme’s integrity.

The NCSC has published guidance on Cyber Essentials for years. The fact that they are now publishing an alternate pathway tells you something about where the friction has been. Cyber Essentials Plus requires a verified assessment, an external assessor actually confirms that controls are in place, rather than relying on a self-assessed questionnaire. For smaller businesses, that assessment process has historically been disruptive. Scheduling it, preparing for it, and passing it represents a meaningful operational burden.

If the new pathway reduces that friction without reducing the rigour of the verified check, that is a meaningful development. If it reduces both, it is less useful.

I will be direct about my inference here, because the blog content available at time of writing is a summary: the NCSC would not publish an alternate pathway unless the existing route was generating drop-off. Businesses starting the process and not completing Plus. That is a certification failure that matters, because Cyber Essentials Plus is increasingly required for public sector contracts and increasingly requested in supply chain questionnaires.

For UK SMBs who have Cyber Essentials basic certification but have not progressed to Plus, this is worth reading before your next renewal conversation with your IT provider or certifying body. The landscape for government contracts and larger client requirements is moving in the direction of Plus. The window for completing it through an easier pathway, if that is what this represents, is worth acting on.

Read the NCSC blog directly. Do not rely on summaries, including this one, for the specific pathway details.

What to Do Today

Three actions, in priority order:

1. Confirm the RoguePlanet patch has been applied. Ask your IT provider or check your endpoint management console. If Defender is your primary protection, this is not optional.

2. Brief developers on dependency verification. The GitHub Go module campaign and the npm/PyPI typosquatting operation are active. If your team pulls open-source packages without a verification step, implement one now.

3. Read the NCSC Cyber Essentials Pathways blog. If you have basic CE certification and have not progressed to Plus, this may change what that progression looks like.

Before the next briefing: if Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s brief lands automatically. And if you know someone who needs the heads-up, pass it on. The people who most need this information are often the ones nobody is sending it to.

Sources

Source	Title	URL
The Register	Microsoft closes book on Nightmare Eclipse’s RoguePlanet zero-day	https://www.theregister.com/security/2026/07/09/microsoft-closes-book-on-nightmare-eclipses-rogueplanet-zero-day/5269280
NCSC	Cyber Essentials Pathways: from proof of concept to cyber confidence	https://www.ncsc.gov.uk/blogs/cyber-essentials-pathways-from-proof-of-concept-to-cyber-confidence
AhnLab ASEC	Vidar Infostealer Being Spread through Phishing Emails	https://asec.ahnlab.com/en/94363/
Socket	Malicious Go Module Exposes GitHub Malware Lure Network Spanning 222 Repositories	https://socket.dev/blog/malicious-go-module-exposes-github-malware-lure-network
Palo Alto Unit 42	Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation	https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/