Threat Analysis: PaperCut Zero-Day, Microsoft Teams Vishing, and the Supply Chain You Forgot to Audit
Hello, Mauven here.
This is your Daily Threat Analysis for the 28th of August 2026.
Three stories today. All three are active. None of them are waiting for you to be ready.
PaperCut Zero-Day: Active Exploitation, No Official Patch
Let us start with the most immediately actionable.
PaperCut, the print management software that sits quietly on servers in law firms, schools, NHS trusts, estate agents, and a significant proportion of UK SMB offices, is under active zero-day attack as of today. The Register confirmed exploitation is ongoing. There is no official vendor patch available at time of writing.
If you run PaperCut, you have two options right now. You can apply an emergency patch that PaperCut itself describes as unvalidated, meaning it has not gone through the full quality assurance process. Or you can take the server offline until a proper fix is available. Those are your choices. Neither is comfortable. Both are preferable to leaving an internet-exposed print server wide open to active exploitation.
PaperCut has form here. The 2023 PaperCut vulnerabilities, CVE-2023-27350 and CVE-2023-27351, were exploited extensively within days of disclosure, including by ransomware groups. The NCSC issued guidance. The advisory told organisations to patch immediately. A substantial number did not, and paid for it.
The fact we are back here again, with PaperCut under active zero-day attack, tells you everything you need to know about how seriously patch management is taken in organisations that consider print servers to be low-priority infrastructure.
Print management software has administrative access to every device on your network that touches printing. It often runs with elevated privileges. It is frequently internet-exposed for remote management. Attackers know this. You should too.
What to do right now:
- Check whether you run PaperCut MF or PaperCut NG in your environment. Ask your IT provider directly if you are not certain.
- If your server is internet-exposed, restrict external access immediately pending a patch.
- Monitor PaperCut’s security advisory page for an official patch and apply it the same day it is released.
- If you have no operational requirement to keep the server online, take it offline until a validated patch exists.
Microsoft Teams Vishing: GoGRPC Backdoor and the Ransomware Pipeline
The second story has been running since January 2026, which tells you something about detection rates.
Zscaler ThreatLabz has published detailed research on a threat actor, assessed as likely functioning as an initial access broker for ransomware operations, that has been targeting organisations through Microsoft Teams vishing attacks. The methodology is straightforward and effective: the attacker calls your staff via Teams, impersonates an IT helpdesk operative, and convinces the target to open a Quick Assist remote session. From there, PowerShell scripts deploy GoGRPC, a Go-based backdoor that exists in four distinct variants and establishes persistent access for downstream ransomware deployment.
The advisory attributes this campaign to an initial access broker. What it does not say explicitly is that the same social engineering playbook, impersonating IT support via Teams to gain remote access, has been observed as a precursor to ransomware delivery repeatedly since 2023. Storm-1811, a group Microsoft tracked in mid-2024, used this exact approach. The tooling has evolved. The technique has not.
For UK SMBs, the specific risk here is the combination of Microsoft Teams normalisation and Quick Assist availability. Quick Assist is a legitimate Windows tool. It is often used by genuine IT support providers. Employees who are accustomed to IT staff connecting remotely to fix problems have no obvious reason to be suspicious when a caller, who appears to be on the company’s own Teams tenant or an external Teams user, asks them to open it.
If your IT support never initiates contact via Teams and never asks you to open Quick Assist without a prior support ticket, that is a policy worth having. If you do not have that policy written down and communicated to staff, you do not have that policy.
The NCSC has published guidance on social engineering and impersonation attacks. The fact this campaign has been running for the better part of eight months without being widely disrupted tells you everything about how seriously staff awareness training is being operationalised in affected organisations.
What to do:
- Brief staff today: legitimate IT support does not cold-call via Teams asking for remote access. Any such request should be verified through a separate channel before Quick Assist is opened.
- Consider restricting Quick Assist via Group Policy if your IT support provider does not use it. Microsoft’s own documentation tells you how.
- If you use a managed service provider, ask them to confirm in writing how they initiate unscheduled remote support sessions. Get a verifiable process, not a verbal assurance.
- Review your Microsoft Teams external access settings. Calls from outside your organisation arriving via Teams should not be the default vector for IT support.
Firmware Implants in the Supply Chain: ZBT Routers
The third story is slower-burning but arguably more structurally significant.
VulnCheck has published research identifying three distinct implants, SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS, embedded in ZBT router firmware that has been distributed through a global supply chain reaching the United States, Canada, Australia, the Philippines, Germany, and Russia. The research does not exclude the UK from the distribution picture, and given the reach of global electronics supply chains through online marketplaces and third-party resellers, UK businesses should not assume they are unaffected.
DARKLANTERN is the most immediately alarming of the three. It is an unauthenticated UDP backdoor listening on port 9992, offering root shell access from the internet. The MAC address bypass described in the research is trivial to execute. This is not a sophisticated post-exploitation tool. It is a wide-open door left in the router’s firmware before it reached the customer.
This is a supply chain compromise at the hardware layer. The router arrived compromised. The organisation that bought it almost certainly ran a security scan on their network and found nothing unusual, because the implant was already in the firmware before the device was unboxed.
For UK SMBs, the practical question is straightforward: where did your office router come from, and can you verify the firmware integrity? If the answer to the second question is that you have no idea, that is the answer that matters.
ZBT is a Chinese router manufacturer. The research does not formally attribute the implants to a nation-state actor, and I will not make that inference where the researchers have not. What the research does establish is that implanted firmware reached customers through what appeared to be legitimate retail channels.
What to do:
- Ask your IT provider or MSP to audit the firmware version and integrity of any routers in your environment, particularly those sourced through online marketplaces or third-party resellers.
- Run a port scan of your internal network looking for unexpected listeners, including UDP port 9992.
- If you cannot verify the integrity of your router firmware, treat the device as potentially compromised and plan a replacement sourced through a verifiable supply chain.
- This is also a reasonable moment to review any other network-attached devices, access points, switches, IP cameras, sourced through grey-market channels.
Also Worth Noting Today
ServiceNow: Three maximum-severity vulnerabilities in the ServiceNow AI Platform were disclosed today, code injection, SQL injection, and privilege escalation. ServiceNow patches are available. If your business uses ServiceNow, your IT provider should be applying these now, not scheduling them for the next maintenance window.
Gitea: Over 8,300 internet-exposed Gitea instances remain unpatched against a critical remote code execution vulnerability that is being actively exploited, according to Shadowserver. If you self-host a Gitea instance for code management, common in small development shops and technical consultancies, check your version today.
The CISA observation worth filing: CISA published a statement today noting that most of the vulnerabilities being actively exploited in 2026 should have been eradicated decades ago. Organisational culture and failure to adopt secure-by-design principles were cited as the primary causes. That framing is accurate and it is also diplomatically phrased. What CISA is describing is an industry that has consistently deprioritised security in favour of feature velocity, and a customer base that has accepted that trade-off without demanding otherwise. The NCSC has been making the same point in different language for years.
The Connective Thread
Look at today’s three primary threats together. A print server under zero-day attack. A social engineering campaign using a legitimate Microsoft tool. Firmware implants in hardware that arrived through a normal purchasing process.
None of these exploited novel cryptographic weaknesses or required nation-state-level resources. All three targeted infrastructure that organisations manage inattentively, because it works, because it is not glamorous, and because the risk feels abstract until it is not.
The CISA observation lands harder in that context. The vulnerabilities being exploited in 2026 are not new. The techniques being used are not new. What is new is the operational efficiency with which attackers are finding and targeting the organisations that have simply not done the basics.
If your IT provider tells you that today’s threats do not affect you because you are too small, ask them how many of the organisations caught by the 2023 PaperCut campaign thought the same thing.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up.