Threat Analysis: Node2Shell Actively Exploited, 123 Reg China-Nexus Breach, and Microsoft Teams as an Attack Vector
This is your Daily Threat Analysis for the 28th of October 2026.
Three items today. All of them actionable. None of them can wait until next week’s IT review.
Node2Shell: CISA Confirms Active Exploitation of Critical Brotli Vulnerability
CISA added Node2Shell to the Known Exploited Vulnerabilities catalogue on the 28th of October 2026. That is the signal that matters. When something lands on the KEV catalogue, it means exploitation is not theoretical, it is confirmed in the wild.
Node2Shell, also referred to in reporting as Broccoli2Shell and HTTP2Shell, is a critical vulnerability in the Brotli compression library as implemented in Node.js. The flaw affects the HTTP/2 request handling layer, and exploitation can lead to remote code execution without authentication. The advisory does not specify which threat actors are exploiting it, or against which sectors. That omission is deliberate; the KEV catalogue does not typically name actors or victims in operational detail.
What the advisory does not say, and what matters operationally, is the surface area here. Node.js underpins a substantial proportion of the web application infrastructure running in UK small and medium businesses, often without anyone in the business knowing it is there. If your business uses SaaS applications, custom web applications built in the last five years, or managed services from an MSP who runs Node.js-based tooling, you have exposure worth verifying.
The patching timeline is also relevant. CISA’s standard federal agency remediation deadline for KEV catalogue additions is 21 days. UK organisations are not bound by that deadline, but it gives you a reasonable benchmark for urgency. If your provider cannot confirm patch status within the next few days, that is a conversation you need to have now.
What to do:
- Ask your MSP or IT provider whether any systems in your environment run Node.js and whether Node2Shell patches have been applied.
- If you manage your own web infrastructure, check your Node.js version and apply the vendor patch immediately.
- If you use a web application firewall, verify whether your provider has deployed mitigations while patches are applied.
- Do not accept “this does not affect you because you are too small” as an answer without a specific explanation of why not.
123 Reg Customer Data Breach: What a China-Nexus Attribution Actually Means for UK SMBs
123 Reg disclosed a breach of customer data on the 28th of October 2026. Company leadership has attributed the attack to threat actors they believe may be the same group that used a toolset called ARTEX to breach South Korean financial institutions.
Let us be precise about what that attribution means and what it does not mean. The company’s leadership suspects a China nexus. That is an inference, not a confirmed government attribution. What it tells you is that the company’s incident response team has compared the tactics, techniques, and procedures observed in this attack against documented campaigns and found a resemblance. It does not mean Chinese state actors were sitting at the keyboard. It does mean the attack appears technically sophisticated and has been compared to campaigns targeting financial sector organisations.
Now consider who uses 123 Reg. It is one of the most widely used domain registrars in the United Kingdom. Hundreds of thousands of small businesses host their domains, and in many cases their email infrastructure, through 123 Reg’s parent company. The customer data held by a domain registrar is not trivial: it typically includes contact details, billing information, domain ownership records, and administrative account credentials.
The phrase “AI cyberattack” in the disclosure is worth examining carefully. Vendors and companies increasingly use this framing to describe attacks that use AI-assisted reconnaissance, automated exploitation, or AI-generated phishing content. It is not a meaningless label, but it is also not a new threat category. What it likely signals in this context is that the attackers used AI tooling to accelerate their operations, the same way security teams use AI to accelerate their defences. The underlying techniques remain familiar: credential access, lateral movement, data exfiltration.
If you are a 123 Reg customer, the relevant questions are: what data was accessed, over what period, and has 123 Reg notified you directly? If you have not received a notification, that does not mean your data was not affected. Breach notifications to individual customers frequently lag the initial disclosure by days or weeks while the organisation scopes the incident.
What to do:
- If you use 123 Reg for domain registration or email hosting, treat your account credentials as potentially compromised and rotate your 123 Reg account password immediately.
- Enable multi-factor authentication on your registrar account if it is not already active. Domain hijacking via a compromised registrar account is a well-documented attack path.
- Check your domain’s authoritative nameserver records for any changes you did not make. A threat actor with registrar access can redirect your domain’s DNS to infrastructure they control.
- If you use 123 Reg email services, review your email account for forwarding rules, delegate access, or other changes that may indicate account compromise.
- Monitor for phishing communications that use your company’s own domain details, attackers with access to registrar data sometimes use that information to make subsequent phishing attempts more convincing.
Microsoft Teams External Chat: 400-Plus Incidents and Still the Default is Open
Arctic Wolf published analysis of over 400 incidents involving the abuse of Microsoft Teams’ external chat functionality for initial access. The research documents a consistent pattern: threat actors create throwaway Microsoft 365 tenants with display names crafted to look like internal IT support teams, often including the string “(Internal)” to suppress the visual warning that Teams displays for external contacts.
The attack sequence typically begins with email bombing, flooding a target’s inbox with subscription confirmations and other legitimate email noise to create confusion, followed by a Teams message from the fake IT support account offering to help resolve the “email problem.” From there, attackers request Quick Assist access or instruct victims to install remote management tools under the guise of legitimate support activity.
CVE-2026-76461, CVE-2026-84869, CVE-2026-85102, and CVE-2026-85103 are associated with this campaign. Four vulnerabilities across the Teams attack chain in a single advisory is notable. The research also references SkyW4lker, an active device-code phishing kit operating since June 2026, which abuses the legitimate OAuth 2.0 device-code authentication flow to bypass MFA entirely. The attack does not steal a password. It generates a device code, convinces the victim to authorise it, and gains persistent token access to the Microsoft 365 account without ever needing credentials.
The advisory attributes campaign activity to threat actors using DarkGate and QakBot as downstream payloads, and references Quick Assist as the remote access vector. Microsoft’s own guidance on disabling or restricting Quick Assist has been available for some time. The fact that 400-plus incidents have been documented using this exact pattern in 2026 alone tells you how many organisations have read that guidance and acted on it.
For UK SMBs, the exposure point is specific and fixable. Microsoft Teams external chat federation is enabled by default in most Microsoft 365 tenancies. If your business has no requirement to receive Teams messages from external organisations, there is no operational reason for that setting to be on.
What to do:
- Review your Microsoft 365 Teams external access settings in the Teams admin centre. Disable external federation if your business does not require it. If you do require it, restrict it to specific allowed domains rather than permitting all external tenants.
- Brief staff that IT support will never contact them unsolicited via Teams requesting remote access. This is a social engineering attack and user awareness is a meaningful control.
- Restrict or disable Quick Assist via Group Policy or Intune if remote support is provided through a different tool.
- Review your conditional access policies to ensure device-code authentication flows are restricted. Device-code flow is a legitimate feature that should not be open to all users in all contexts.
- If you use Microsoft 365, ensure phishing-resistant MFA (FIDO2 keys or certificate-based authentication) is deployed for your highest-value accounts. Standard TOTP-based MFA does not stop device-code phishing.
On the Margins: Oracle EBS Scanning and the Qilin Context
Two items worth a brief note before closing.
Attackers began scanning for systems unpatched against CVE-2026-101767, a critical Oracle E-Business Suite vulnerability, on the 28th of October 2026. Oracle EBS is enterprise-grade software not typically found in SMB environments directly. However, if your business relies on an accountancy firm, a payroll provider, or a legal practice that runs EBS, you have downstream exposure. Supply chain risk does not care about your organisation’s size.
Qilin ransomware has also received detailed technical analysis published today. Qilin is a Russian-speaking ransomware-as-a-service operation active since 2022, with over 1,000 claimed victims by 2025. The group specifically targets VMware ESXi hypervisors, which means that virtualised infrastructure, including the kind commonly sold as managed services to UK businesses, is a target. Affiliates gain initial access through phishing. The ransomware itself is written in Rust and targets local files, network shares, and virtual machine infrastructure simultaneously. If your business uses a managed service with virtualised servers, ask your provider what their ESXi patching and snapshot isolation posture looks like.
Sources
If this briefing is useful to you, follow Threat Analysis wherever you listen so tomorrow’s briefing lands without you having to go looking for it. And if someone in your network needs the heads-up on today’s items, a colleague, an IT provider, a business owner who thinks they are too small to be a target, pass it on. The 123 Reg breach affects UK businesses of every size. The Teams attack pattern has been documented in over 400 incidents. The window between a CISA KEV listing and widespread exploitation is measured in days, not weeks.