[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”||65px|||” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2026\/02\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
Published: January 16, 2026<\/em><\/p>\n <\/em><\/p>\n Our bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/p>\n [\/et_pb_text][et_pb_heading title=”Featured Cyber Threat \u2014 Credential Harvesting” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2026\/02\/27-sign-in.png” title_text=”27-sign-in” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.6″ _module_preset=”default” header_3_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n Many cybersecurity incidents may look different on the surface, but they often begin the same way\u2014attackers gather legitimate login credentials and use them to access systems, acting as if they were authorized users. This technique, known as credential harvesting, continues to be one of the most common paths to data theft and exposure.<\/span><\/p>\n The latest updates from the Cybersecurity and Infrastructure Security Agency (CISA) reinforce that credential harvesting remains a primary entry point for both criminal and state-sponsored cyber activity. CISA’s recent Malware Analysis Report on the BRICKSTORM Backdoor, jointly released with its partners, confirms that attackers are actively extracting credentials to maintain long-term access<\/a>. For small businesses, this shows why credential harvesting is an ongoing threat that requires consistent attention to prevention.<\/span><\/p>\n Credential harvesting refers to the technique used to gather valid usernames, passwords, authentication tokens, or other login information. With these legitimate credentials, attackers can access systems without triggering noticeable alarms.<\/span><\/p>\n This method continues to be effective for the following reasons:<\/span><\/p>\n Once credentials are harvested, attackers can move through systems, access sensitive data, or deploy ransomware quietly.<\/span><\/p>\n [\/et_pb_text][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2026\/02\/27-tech.jpg” title_text=”27-tech” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.6″ _module_preset=”default” header_3_text_color=”#00688E” custom_css_free_form=”ol {|| list-style: none !important; || counter-reset: item; ||}||||ol li {|| counter-increment: item; || position: relative; || padding-left: 2em; \/* Adjust as needed for spacing *\/||}||||ol li::before {|| content: counter(item) %22.%22; || font-weight: bold; || position: absolute;|| left: 0; || width: 1.5em; || text-align: right;||}” global_colors_info=”{}”]<\/p>\n The following recent government updates highlight that credential harvesting remains a common access method across different threat types.<\/p>\n Small businesses are frequently targeted because credential controls are often assumed to be handled by IT service providers or built-in tools. In reality, gaps around identity, patching, and remote access are often present. To mitigate risk, your business can take the following practical steps:<\/span><\/p>\n Credential harvesting is not a new threat, but it remains one of the most common ways attackers gain access. Recent government advisories underscore that both criminal and state\u2011sponsored actors continue to gather legitimate credentials and use them to work their way through systems without triggering alerts. For small businesses, revisiting basic security controls around identity, patching, and remote access is one of the most effective ways to reduce potential risk.<\/p>\n The NCSS encourages businesses to adopt comprehensive security practices and stay informed about evolving threats. We recommend you consider becoming an NCSS member to access a wide range of our services. For more information, visit our Small Business page<\/a><\/span>.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”|auto|-44px|auto||” custom_padding=”71px||0px|||” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_divider _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”||-2px|||” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_2_font=”|600|||||||” header_2_text_color=”#00688E” custom_margin=”||2px|||” custom_padding=”||0px|||” global_colors_info=”{}”]<\/p>\n https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/12\/19\/cisa-and-partners-release-update-malware-analysis-report-brickstorm-backdoor<\/a><\/span><\/p>\n https:\/\/industrialcyber.co\/cisa\/cisa-nsa-sound-alarm-on-brickstorm-backdoor-used-by-china-linked-actors-targeting-vmware-windows-systems\/<\/a><\/span><\/p>\n https:\/\/www.techradar.com\/pro\/security\/under-the-radar-google-warns-new-brickstorm-malware-was-stealing-data-from-us-firms-for-over-a-year<\/a><\/span><\/p>\n https:\/\/www.cisa.gov\/ed-25-03-guidance-device-updates-and-patching<\/a><\/span><\/p>\nHow Credential Harvesting Works<\/h3>\n
\n
What Recent Government Warnings Show<\/h3>\n
\n
Why It Matters and What to Do for Your Business<\/h3>\n
\n
<\/span><\/strong>– Remove unused or inactive accounts, such as those for former employees, contractors, and vendors
– Limit administrative privileges so everyday tasks are not performed with admin-level access
– Avoid shared credentials for email, accounting systems, document sharing platforms, messaging tools, and remote access, which make misuse difficult to trace<\/li>\n
<\/strong>– Verify that necessary updates were applied correctly, not just scheduled or assumed to be completed
– Confirm regularly that updates are fully completed, including operating systems, business applications, and network devices such as firewalls<\/a>, virtual private networks (VPNs)<\/a>, and routers
– Replace unsupported hardware or software that can no longer receive security updates<\/li>\n
<\/strong>– Require multi-factor authentication (MFA)<\/a> for all remote connections, not only for administrators
– Review who has remote access and whether it is still required for their role
Monitor for unusual login activity, such as access outside normal business hours or from unexpected locations<\/li>\n<\/ol>\nConclusion<\/h3>\n
References<\/span><\/strong><\/h2>\n