The Ladder Rung Problem: What 2026's Most Dangerous APTs Mean for Your Small Business

The Threat Landscape SMBs Actually Need to Care About

Small business owners in Australia hear "APT" and tune out. Nation-state hackers. Spy agencies. That's for banks, Defence, and ASX200 companies. Not for a plumbing business in Geelong or a bookkeeping firm in Parramatta.

That logic was reasonable in 2019. It is dangerous in 2026.​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌‌​‌​​‍​‌‌​‌​​​‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​​‍​‌‌‌​​‌‌‍​‌‌​​​‌‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

The three most active threat groups right now don't breach your business because they want your data. They breach it because you have a relationship with som

eone they do want. You're the vendor with API access to a hospital's procurement system. You're the accountant with delegated mailbox permissions at a mid-tier law firm. You're the IT contractor with RMM tools installed across 14 client networks.

Here are the groups running this playbook right now and which one should keep you up at night.

Scattered Lapsus$ Hunters: The Supergroup That Broke Salesforce

In 2025, three of the most destructive cybercrime groups on earth, Scattered Spider, Lapsus$, and ShinyHunters, merged into a single entity calling itself Scattered Lapsus$ Hunters. Their first joint operation compromised an estimated 1.5 billion records from Salesforce customer environments, not by breaching Salesforce itself, but by compromising a third-party integration called Salesloft Drift. OAuth tokens stolen from that integration gave them access to 39 major organisations' Salesforce instances.

The technique matters. Scattered Spider brings expertise in help-desk social engineering, convincing IT support staff to reset MFA for accounts the attackers already control. Lapsus$ brings the insider-recruitment playbook: paying employees for credentials and VPN access. ShinyHunters brings industrial-scale data harvesting and extortion. Combined, they have built an extortion portal on the dark web where victim companies are listed with data samples and ransom deadlines.

For an SMB, the risk is straightforward. If your company uses any SaaS platform with third-party integrations, you inherit the security posture of every vendor in that chain. The Salesloft Drift compromise didn't require anyone to click a phishing link. It required one integration to be vulnerable.

Volt Typhoon: Living Off Your Land

Volt Typhoon is a Chinese state-sponsored group that CISA has confirmed maintains persistent access inside US critical infrastructure networks, including telecommunications, energy, and water utilities. Their signature technique is "living off the land" (LOTL): they use your own Windows tools, PowerShell, WMIC, and native OS binaries to move through networks because those tools don't trigger antivirus alerts.

Volt Typhoon targets network devices that sit below the EDR layer, edge routers, VPN concentrators, and unpatched Cisco appliances. Once inside, they extract Active Directory databases, dump credentials, and establish firmware-level persistence that survives OS reinstalls. CISA's advisory explicitly states that eviction from compromised networks has proven extremely difficult, with some dwell times measured in years.

The SMB angle? If you provide managed services to a larger organisation, your RMM agent, your remote access tool, your VPN concentrator, is the bridge Volt Typhoon uses to cross from your network into your client's. They don't need to breach the target directly. They breach the path of least resistance: you.

Salt Typhoon: The Telecom Heist Goes Global

Salt Typhoon, attributed to China's Ministry of State Security, spent 2025 and early 2026 expanding from US telecom carriers into carriers across the UK, Australia, and Canada. Their playbook targets Cisco IOS XE edge devices, implants custom firmware backdoors, and harvests call-detail records and signalling metadata by abusing lawful-intercept interfaces built into carrier equipment. Once embedded in a telecom provider's infrastructure, their presence is invisible to endpoint detection tools because it operates at the network-device firmware layer.

For an SMB, the direct threat is limited unless you run carrier-grade network infrastructure. The indirect threat is not: every business phone call, every SMS-based MFA code, every VoIP conversation routed through a compromised carrier is potentially exposed. The ACSC has issued no public statement confirming Australian carrier compromise as of May 2026, but Salt Typhoon's methodical geographic expansion pattern means Australian network operators should assume targeting is active.

Three Detections You Can Set Up This Week

Most SMBs don't have a SOC. Most don't have a SIEM. Here are three things you can implement with tools you already have or can get free.

1. Monitor for new OAuth application grants in Microsoft 365. Scattered Lapsus$ Hunters and APT28 both steal OAuth tokens and register malicious applications that persist even after password resets. In the Azure AD / Entra ID portal, enable alerting for any new application consent grant. If a user grants "Mail.Read" to an app called "SalesforceIntegrationHelper" and nobody in IT approved it, you have an incident. This takes 15 minutes to configure and costs nothing.

2. Block outbound RDP, SSH, and SMB from workstations at the firewall level. Volt Typhoon and Salt Typhoon both use lateral-movement techniques that require outbound connections on ports 3389, 22, and 445. Your workstations have no legitimate reason to initiate RDP connections to the internet. Block those ports outbound. If your firewall can't do it, Windows Firewall can. Group Policy it. This single rule breaks multiple stages of the kill chain.

3. Inventory your edge devices and check for end-of-life firmware. Salt Typhoon specifically targets Cisco IOS XE, Fortinet FortiOS, and Ivanti Connect Secure appliances that are unpatched or end-of-life. Make a list of every device that faces the internet: routers, VPN gateways, NAS devices, IP cameras, building-management controllers. For each one, check the vendor's security advisory page for CVEs disclosed in the last 12 months. If the device is end-of-life and the vendor no longer ships firmware updates, replace it. If it's supported but unpatched, patch it this week. The average time from CVE publication to active exploitation in 2025 was under five days. You don't have a monthly patch cycle. You have a window measured in hours.

FAQ

Conclusion

The 2026 APT landscape is not about attackers who target you. It's about attackers who use you. Scattered Lapsus$ Hunters exploit the trust relationships in your SaaS stack. Volt Typhoon exploits your network devices. Salt Typhoon exploits the carriers your business runs on. None of them wake up thinking about your company. All of them will compromise it if it gets them to their actual target.

Start with the three detections above. They close the most common initial-access and lateral-movement paths these groups rely on. Then map your digital supply chain: every vendor with API access, every client with a VPN tunnel, every SaaS integration with OAuth permissions. You cannot defend what you have not mapped.

If you're not sure where to start, we'll map it with you. Visit consult.lil.business for a free cybersecurity assessment for your Australian small business.

References

1. CISA Advisory AA24-038A: Volt Typhoon TTPs and Persistent Access
2. Splunk Research: Scattered Lapsus$ Hunters Analytics Story
3. Picus Security: Scattered Lapsus$ Hunters — 2025's Most Dangerous Cybercrime Supergroup
4. Vectra AI: Salt Typhoon Threat Briefing — TTPs and Detection
5. ACSC Essential Eight Maturity Model