Threat Analysis: Web Skimming, IoT Botnets, and Search Engine Fraud Targeting UK SMBs
This is your Daily Threat Analysis for 15th September 2026.
Today’s brief covers three active threats. Two of them, web skimming via Google Tag Manager and a pair of new IoT botnets, have direct, concrete relevance to UK small businesses. The third is a search engine fraud campaign that is less technically complex but likely to catch someone in your organisation off guard. I have picked these three because they represent different attack surfaces and different types of victim. If only one of them applies to you, that is still a reason to read on.
GrelosGTM: Payment Skimming Hidden Inside a Marketing Tool
Group-IB published detailed research this week on a cybercriminal group they call GrelosGTM. The group has been active since at least April 2020, and by early 2021 had evolved their approach to something considerably more difficult to detect: injecting malicious scripts directly into Google Tag Manager containers on compromised e-commerce sites.
The UK is explicitly listed among the affected countries.
Google Tag Manager is the marketing analytics tool that most e-commerce businesses use to manage tracking scripts, things like Google Analytics, Facebook Pixel, and conversion tracking. It is designed to let non-technical staff add and update scripts without touching the site’s source code. That flexibility is precisely what makes it attractive to attackers. Once inside a GTM container, a malicious tag looks like any other piece of marketing code. It will not trigger standard file integrity checks. Your developers are unlikely to review it routinely. And your payment processor will not see it, because the skimmer captures card data on the client side, before it ever reaches the payment gateway.
The campaign targeted sites running Magento CMS. Magento is widely deployed among UK independent retailers and B2B wholesale businesses, often maintained by small agencies or in-house developers who may not be monitoring GTM containers for tampering.
What the Group-IB report does not say explicitly, but is worth inferring: this style of attack is difficult to attribute in the early stages. If your customers report fraudulent transactions and you cannot find any obvious breach in your payment system, your GTM container is now a place you need to check.
What to do: If you run a Magento-based e-commerce site, log into your Google Tag Manager account today and review every tag in your container. Any tag you did not deliberately add is a problem. If you use an agency to manage your site and they have GTM access, ask them to provide a full audit of container contents. This is not an unreasonable request; any agency that cannot produce one quickly is one you should be having a separate conversation with.
KATARU and Evooo1Bot: Two IoT Botnets Scanning for Unpatched Devices
Two separate IoT malware campaigns emerged this week, and while neither is exclusively targeting UK businesses, both represent ongoing background noise that catches organisations with unpatched edge devices.
KATARU, documented by Nozomi Networks, was discovered in August 2026 through Telnet credential brute-forcing observed on a honeypot, with the traffic originating from Vietnam. It is built on the Mirai model, brute-force entry via default or weak credentials, but extends this with multiple Linux local privilege escalation exploits (CVE-2026-31431, CVE-2026-43284, CVE-2026-46300), encrypted command-and-control, and persistence mechanisms designed to survive reboots on both standard Linux systems and embedded platforms. The LPE capabilities are notable: they suggest the operators expect to land on devices where they do not have root access and need to escalate. That is a more sophisticated playbook than classic Mirai.
Evooo1Bot, reported by Infosecurity Magazine, has been active since July 2026. Also Mirai-derived, it exploits a range of CVEs in internet-facing edge devices, including vulnerabilities dating back to 2007, which tells you something about the state of patching in the wild. Its distinguishing feature is a reverse SOCKS relay capability, which turns compromised devices into proxy infrastructure. Criminals use this to launder attack traffic through legitimate IP addresses, including, potentially, your office’s IP address. That has consequences beyond the device itself: your business’s IP reputation can be affected, and traffic routed through your device could be used in attacks on others.
For a UK SMB, the practical risk is straightforward. If you have a router, NAS device, VPN appliance, or any other internet-facing hardware that has not been updated in the last six months, it is a candidate for either campaign. If the device’s manufacturer has issued no updates in the last year, the operating assumption should be that it will not be patched and should be replaced.
CVE-2024-21762, a FortiGate SSL-VPN vulnerability exploited in a separate campaign documented by Hunt.io, is also worth flagging here. Fortinet patched this in early 2024. The fact it is still appearing in active intrusion campaigns in 2026 is consistent with what we see repeatedly: appliances that are purchased, deployed, and then left to run without a structured patching process. Fortinet devices are common in UK SMB environments, often deployed by MSPs as the perimeter gateway. If your MSP manages a FortiGate appliance for you, ask them to confirm the current firmware version and when it was last updated. Not next week. Today.
What to do: Conduct a five-minute audit of your internet-facing devices. Router, VPN appliance, NAS, network-attached cameras, anything with an IP address that faces the internet. For each one, check whether there is a firmware update available. If there is, apply it. If your MSP manages these devices, ask for written confirmation of the current firmware version on each one. If a device is end-of-life and no longer receiving updates, add it to a replacement list and prioritise it.
Search Engine Fraud: Fake Crypto Gift Card Checkouts
Malwarebytes documented a campaign this week in which criminals have created convincing fake versions of Bitrefill, a legitimate service for purchasing gift cards and eSIMs using cryptocurrency, and are surfacing these fake sites in search engine results through typosquatting and Punycode domain manipulation.
I include this not because cryptocurrency gift cards are a primary risk vector for most UK SMBs, but because the underlying technique, creating convincing lookalike sites that appear in organic search results, not just paid ads, is being used across a range of sectors. The mechanics are the same whether the target is a crypto service, an accounting software portal, or a payroll provider login page.
If you have staff who access financial services or supplier portals via search engine rather than bookmarked URLs, this is a social engineering risk worth one brief conversation at your next team meeting.
What to do: Encourage staff to bookmark critical supplier and financial service URLs rather than searching for them each time. For high-value portals, consider whether your IT setup can enforce approved URL lists.
The Pattern
These three campaigns are unrelated in their operations, but they share a common thread: they exploit the assumption that your tools, your infrastructure, and your search results can be trusted. GTM containers can be tampered with. Edge devices can be silently recruited. Search results can lie. None of this requires a sophisticated nation-state actor. Organised criminal groups with modest technical capability are doing all of it, at scale, against targets of every size.
The NCSC has published guidance on securing e-commerce sites and managing third-party scripts. The fact that web skimming via tag management platforms remains an active and effective attack vector tells you how widely that guidance has been implemented.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and if you know someone who needs the heads-up, pass it on.
Sources
| Source | Title | URL |
|---|---|---|
| Group-IB | GrelosGTM group abuses Google Tag Manager to attack e-commerce websites | https://www.group-ib.com/blog/grelosgtm/ |
| Nozomi Networks | KATARU: IoT Malware Adopts Public LPE Exploits | https://www.nozominetworks.com/blog/kataru-iot-malware-adopts-public-lpe-exploits |
| Infosecurity Magazine | New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies | https://www.infosecurity-magazine.com/news/new-linux-botnet-evooo1bot-victims/ |
| Malwarebytes | Search results are sending people to fake Bitrefill checkouts | https://www.malwarebytes.com/blog/threat-intel/2026/09/search-results-are-sending-people-to-fake-bitrefill-checkouts |
| Hunt.io | Thai Broadband Provider Targeted via FortiGate SSL-VPN and MeshCentral Persistence | https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion |