Profiling the opportunistic attacker

# Profiling the opportunistic attacker This week's data highlights one category dominating the wire: the unknowns. North of 17 stories fall under this label, but there is no catchy group name or manifesto behind them. It is simply the bucket where we dump every script kiddie, freelance extortionist, and automated botnet that doesn't leave a distinct enough signature for security firms to brand as an APT. For a ten-person shop, this is actually the only actor that matters. You aren't being hunted by state-sponsored cells in concrete bunkers. You are being scanned by scripts that don't know your company exists and don't care if you sell accounting software or organic dog treats. The playbook here is purely mechanical. These attackers do not spend weeks on reconnaissance. They look for an open door. The recent Redis cryptomining botnet compromised 3,562 servers in this exact way; it didn't use social engineering or complex lateral movement. It found exposed services and took them. When these actors move from cryptomining to ransomware, they follow the same path. They wait for a high-impact vulnerability to drop, and think of the N-able N-central pre-auth RCE (CVE-2026-86218) or the SonicWall SMA1000 flaws that hit a CVSS 10 score this week. Once an exploit is public, they automate the search for every unpatched instance on the internet. The enterprise response to this threat is usually buying an expensive AI-driven detection suite, and that's a waste of money for a small firm. Enterprises pay for visibility into thousands of different endpoints. You only have a handful. You do not need a dashboard to tell you your firewall is out of date. There is one question worth asking here: where does this actually hurt the most? It isn't the initial breach itself; the danger lies in the second-order effect on the supply chain. If you are a small MSP or a niche software provider, these opportunistic attackers aren't just stealing your data, and they are using your trusted access to get into your clients' systems. An attacker doesn't need to hack twenty different small businesses if they can compromise one tool that those businesses all trust. Some will argue this is an exaggeration, and they claim "unknown" criminals only go after the biggest fish for the biggest payouts. That's a misunderstanding of how automation works, and a script does not choose targets based on revenue; it chooses them based on whether the port is open. You aren't too small to be a target. You are just another IP address in a range being scanned by a bot in a different time zone. Attribution reports are mostly wishful thinking; when analysts say an attack "looks like" a specific gang, they are often guessing based on the ransomware variant used. But since these tools are sold as a service on the dark web, using a certain strain of malware doesn't reveal who is behind the keyboard. It only tells you what tool they bought. The cost difference here is stark; an enterprise will spend six figures on a SOC to monitor for indicators of compromise. A small shop can achieve roughly the same level of protection against opportunistic attacks by spending zero dollars and thirty minutes a month on basic hygiene. If you aren't patching your edge devices within the windows provided, such as the tight 3-day deadline CISA signaled for those SonicWall flaws, you are essentially leaving your front door unlocked in a neighborhood where everyone is checking door handles. Microsoft just put out patches for 974 vulnerabilities this month, and nearly 1,000 holes is an absurd number, and it explains exactly why the "unknown" actor succeeds. They don't need to find one perfect way in; they just need you to miss one of a thousand patches. Stop worrying about who is attacking you. The name doesn't matter. What matters is that they are using automation to find the people who aren't using automation to patch. Check your external-facing appliances for pending updates before the end of the day.