The MSP Security Gap
The backups were gone before the ransom note
The scenario:
Monday, 6:50am, your client’s screens show the ransom note. The immediate thought is the right one: restore from backup, refuse to pay.
The backup console shows the last good restore point was deleted nine days ago. So were the ones before it. The retention policy was quietly changed three weeks back.
How it unfolds:
Modern ransomware crews do the encryption last. First they get in, find the backup platform, and take it apart: retention shortened, immutability switched off where it was never locked, cloud copies deleted, the backup service account they compromised doing all of it with legitimate credentials.
Then they wait out the old retention window. Only when the way back is gone do they encrypt, because a victim with no restore path negotiates differently.
The nine days between the first backup deletion and the ransom note were the entire opportunity. Everything in that window looked like an admin doing admin things.
Backup vendors now describe this as standard adversary behavior rather than an edge case. In most successful ransomware incidents the backup layer is attacked first, and the organizations holding a genuinely immutable copy are the outliers in the negotiation statistics, because they recover without paying.
The warning signs:
Retention policy changes nobody requested.
Backup jobs deleted, disabled, or shrinking in scope.
The backup service account signing in outside its schedule, or from new places.
Immutability or versioning settings changing anywhere in the backup chain.
Stop it:
Make at least one backup copy genuinely immutable, locked so no credential in the estate shortens or deletes it, including yours.
Separate the backup platform’s identity from the domain it protects: separate credentials, separate MFA, no shared admin accounts.
Alert on the settings, not only the jobs: retention changes and immutability changes are incidents until proven otherwise.
-
P.S. very warning sign above fires days before any encryption starts, in the quiet window where the attack is preparing rather than executing. That window is where a SOC earns its keep: an alert on a retention change on a Tuesday is worth more than the fastest response to a ransom note the following Monday.
Patch first this week:
This week’s KEV additions, ranked by what MSPs run across client fleets. Verified against NVD, CISA, and vendor advisories.
• Oracle HTTP Server and WebLogic Server Proxy Plug-in CVE-2026-21962 (10.0)
Improper access control in the WebLogic Server Proxy Plug-in for Apache and for IIS. An unauthenticated attacker sends ordinary HTTP requests and bypasses the access rules the proxy is there to enforce. Oracle scored it 10.0, and the scope change in the vector is the reason. The proxy is a doorway, so what an attacker reaches is not the proxy, it is every application sitting behind it. CISA marked exploitation active and automatable, which in practice means scanners are already sweeping for it.
Who runs it: clients with a line of business application on Oracle Fusion Middleware, usually finance, manufacturing, or anything bought before 2015 and never replaced. The proxy tier is normally the Apache or IIS box in the DMZ that the network team owns and nobody patches on a schedule. Affected: 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, and for the IIS plug-in only 12.2.1.4.0.
Fix: apply Oracle’s January 2026 Critical Patch Update. KEV August 24. Federal deadline was August 27, now passed. The patch has been sitting there for seven months, so treat any exposed instance as needing a look at logs rather than just a version bump.
• TrueConf Server CVE-2026-72529 (9.8)
Missing authentication on a critical function. A remote attacker who can reach TCP port 4307 calls an undocumented function and runs an arbitrary script. No account, no credentials, no user action. Kaspersky’s ICS CERT team published the advisory and named the Head Mare group as the party using it, paired with the code injection flaw below.
Who runs it: clients running on-premises video conferencing rather than Teams or Zoom, which in most fleets means the ones with a data residency requirement or a policy against cloud meetings.
Affected: TrueConf Server 5.3.x up to 5.3.9, 5.4.x up to 5.4.9, 5.5.x up to 5.5.5, and anything older, on both Windows and Linux. Fixed in 5.3.9, 5.4.9, and 5.5.5, released in June 2026. KEV August 20. Federal deadline was August 23, now passed. Patch it, then check whether port 4307 has ever been reachable from outside the network, because this one needs nothing more than a route to the server.
• TrueConf Server CVE-2026-72530 (9.0)
The second half of the same chain. Code injection that lets an attacker break out of the isolated environment and run code on the host operating system underneath. On its own it is harder to reach. Chained behind the authentication bypass above, it turns a conferencing appliance into a foothold on the server. The reported campaign used that foothold to replace the TrueConf client distribution files, so every user who downloaded or updated the client from that server received malware. That is a supply chain hit on your client’s own staff, delivered by a system they trust.
Who runs it: the same clients as above, and the ones most likely to have staff installing the client from an internal link.
Affected and fixed: the same version ranges and the same June 2026 releases as CVE-2026-72529, so one upgrade closes both. KEV August 20. Federal deadline is September 3, which is two days after this email lands. If a client is running TrueConf on-premises and you have not upgraded, treat the installer files on that server as suspect before you sign the ticket off.