2026 MSP Threat Report for Australian Businesses

The 2025 threat landscape

Six ways attackers got in last year.

Each category is taken from the report and translated into what it means for an Australian business. Pick one to read how it worked and where the exposure sits.

Ransomware: faster, more frequent

Victim counts surged to record levels, peaking in Q4 2025. Growth came from more reliable access methods, not new encryption. What it means here: For Australian SMBs the risk is not being singled out, it is being part of a large pool of opportunistic targets. For too many, the easiest path in starts at the VPN.

Double extortion remained the dominant model: encrypt the files, steal the data, then pressure on a public leak site.
Akira affiliates used stolen VPN credentials, then moved quickly: scan, steal, encrypt, with little effort to dwell quietly.
Backup infrastructure was targeted early to prevent recovery and raise the pressure to pay.
Fragmented extortion groups replaced takedowns, leaving a resilient ecosystem that complicates attribution and response.

Exposure check

Would these attacks work on you?

Seven controls that would have stopped or slowed the attacks in the report. Tick the ones you could prove today. What is left is your order of work.

Tick each control you could prove today, not the ones you hope are in place.

Remote access is patched, monitored and not left wide openYour SSL VPN or remote access portal is on current firmware, failed logins are watched, and it is not reachable by anyone on the internet without checks.
MFA was reset after any firewall or VPN migrationOld passwords and one-time code seeds were not carried across when the appliance was upgraded or replaced.
Staff cannot install software on their ownApplication control or admin rights removal stops free PDF editors, browser add-ons and 'helpful' utilities being installed without review.
Staff know never to paste a command a website asks forTraining covers ClickFix specifically: fake CAPTCHA or 'fix this error' pages that ask you to press Windows+R and paste.
Backups are immutable and use separate loginsAn attacker with your admin password still cannot delete or change backups, and a restore has been tested this year.
Someone is watching behaviour around the clockA person reviews unusual sign-ins, scanning tools and attempts to switch off security software, at night and on weekends.
Payments and bank changes are confirmed by phoneAny request to pay or change bank details is checked on a known number, not by replying to the email or chat that asked.

Where you stand

0of 7 controls in place

7 gaps to close.

Remote access is patched, monitored and not left wide openExposed VPNs were the most common way in. Akira went from VPN login to full domain compromise in under two hours in several incidents.
MFA was reset after any firewall or VPN migrationSonicWall Gen7 devices upgraded from Gen6 were breached through inherited credentials (CVE-2024-40766), even with MFA on.
Staff cannot install software on their ownTamperedChef and EvilAI hid inside free, code-signed utilities found through ads and search results.
Staff know never to paste a command a website asks forClickFix now has its own MITRE ATT&CK technique, T1204.004, because it works so reliably.
Backups are immutable and use separate loginsRansomware crews went after backups early, on purpose, to force payment.
Someone is watching behaviour around the clockAttacks blended into normal activity. Detection after encryption starts is too late.
Payments and bank changes are confirmed by phoneA deepfake video call with real-time face swapping cost one business over A$880,000.

Based on the attack patterns in the ConnectWise 2026 MSP Threat Report.

Book a security risk review

What the report found

Initial access was rarely sophisticated. It was reliable.

Across the investigations behind this report, most successful intrusions began with credential abuse, a misconfigured VPN, or a user persuaded to run a command. Attackers did not need a zero-day when a valid path already existed.

The common thread was trust. Security controls that assumed trust, rather than checking it, were routinely bypassed. For Australian businesses that lean on remote access and a small internal team, that is the uncomfortable part: the front door was usually left open by ordinary gaps, not clever ones.

Reactive security kept failing. Detection after execution was often too late. The environments hit hardest had limited identity monitoring, weak application control, or poor visibility into how processes were actually launched.

58%

rise in ransomware victims added to leak sites, year on year

ConnectWise 2026 MSP Threat Report

Q4

the most dangerous period of 2025 for ransomware

ConnectWise 2026 MSP Threat Report

< 2 hrs

from VPN access to full domain compromise in several incidents

ConnectWise 2026 MSP Threat Report

T1204.004

the MITRE ATT&CK technique now assigned to ClickFix

MITRE ATT&CK

Anatomy of an incident

How Akira moved from VPN to full compromise.

Akira was one of the most disruptive ransomware operations of 2025, with a consistent lifecycle and little effort to stay quiet. In several incidents the path from VPN login to full domain compromise took under two hours.

1. AccessStolen VPN credentials log in to an exposed SSL VPN. Even with MFA on, migrated one-time code seeds or inherited credentials let attackers walk in.
2. ReconNetwork scanners such as Advanced IP Scanner and SoftPerfect map the environment. Active Directory and credentials are dumped with Mimikatz and Ntdsutil.
3. StealBackup credentials are harvested and restore points removed. Data is staged with WinRAR and taken out using Rclone, WinSCP or FileZilla.
4. EncryptEndpoint protection is switched off through a vulnerable driver, then the payload encrypts files across systems. Double extortion follows.

Security analyst watching a world map of attack paths and alert dashboards at night — Behaviour-based monitoring catches the recon stage, before encryption starts.

The takeaway: if you are not catching attackers at the VPN login or the recon phase, you are catching them too late. Backups are targeted early and on purpose, which is why immutable storage and tested restores matter as much as prevention.

From insight to action

The defences that actually moved the needle.

The report's recurring conclusion is that security has to shift earlier in the attack lifecycle. These are the controls that mattered in 2025, and how we deliver them for Australian businesses.

Identity and privileged access
Identity and access failures sat at the centre of the most damaging incidents. Remove standing privileges, enforce least privilege and just-in-time elevation, and audit every administrative session.
Zero Trust architecture
Hardened, monitored remote access
SSL VPNs need treating as critical infrastructure, not background noise. Continuous login monitoring, phishing-resistant MFA, credential rotation after migrations, and firmware kept current.
Managed IT and cybersecurity
Managed Detection and Response
Signature-based detection is too late when attacks blend into normal activity. Behaviour-based monitoring catches anomalous authentication, suspicious tooling and attempts to impair security controls early.
Managed Detection and Response
Application control and endpoint privilege
Trojanised installers and ClickFix both rely on user execution of legitimate tooling. Safelist what can be installed, verify installers, and watch script interpreters and persistence mechanisms.
Essential Eight compliance
Immutable backup and tested recovery
Ransomware operators target backups first. Immutable storage, backup access isolated from production credentials, and regularly tested restores keep recovery possible when everything else is bypassed.
Backup and disaster recovery
AI-aware verification and governance
Deepfakes and AI-crafted lures defeat email-only awareness. Multi-channel verification for payments, browser extension allowlists, and a clear acceptable-use position on AI tools.
AI threats for Australian SMBs

Where to start

Turn the report into a plan.

Step 1Lock down remote access
Patch and monitor the VPN, reset credentials after any migration, and move to phishing-resistant MFA.
Step 2Protect the backups
Immutable storage, separate logins, and a restore you have actually tested this year.
Step 3Control what runs
Application control and no local admin rights, so trojanised tools and ClickFix commands fail.
Step 4Watch behaviour 24/7
Managed detection and response, with a person able to act at 2am, not just an alert in an inbox.

Read, learn and connect

Free to read. Written by the people who do the work.

Everything here is free, with no email gate on the guides. If you want help putting any of it into practice, the same engineers are a phone call away.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What businesses ask us about the report.

Is the MSP Threat Report relevant to a small Australian business, not just an MSP?

Yes. The report studies attacks on the small and mid-sized businesses that MSPs support, which is exactly the profile of most Australian organisations. The patterns, credential abuse, VPN compromise, ClickFix and trojanised software, are the same ones hitting local businesses, often through the same exposed remote access.

We have MFA on our VPN. Are we covered?

Not automatically. The report documents incidents where MFA was enabled but attackers still got in, by reusing migrated one-time code seeds, enrolling their own device, or using credentials inherited from older firmware. MFA needs to be set up well and the appliance kept current and monitored, not treated as set and forget.

What is ClickFix and why does it matter?

ClickFix is social engineering that convinces a user to copy and paste a command into the Windows Run dialog, usually disguised as a CAPTCHA or a file repair step. Because the user runs it themselves through legitimate tools, it slips past email and file-based defences. Legitimate services never ask you to paste a command, so staff awareness of this specific behaviour is the practical defence.

How is AI changing the threats we face?

Mostly by increasing scale and quality rather than introducing entirely new attacks. The report cites deepfake video and voice fraud, AI-written phishing that gets past filters, and malicious browser extensions that change what you type into AI assistants. The fingerprints are often invisible in the evidence, but the volume and realism of attacks has clearly stepped up.

Where should we start?

Identity and remote access first, because that is where most intrusions began. Then immutable, tested backups, because ransomware targets recovery early. A short risk review will tell you which gaps apply to your environment, and we can map a practical order of work from there.

Who wrote the report, and can I read it myself?

The ConnectWise 2026 MSP Threat Report, subtitled "How Modern Attacks Abuse Trust and Identities", was published by the ConnectWise Cyber Research Unit on 5 March 2026. It draws on incident response investigations, partner telemetry and ransomware leak-site data from calendar year 2025. The full report is free on the ConnectWise website, linked at the foot of this page.

Next step

Turn the report's findings into a plan.

We will review your identity, remote access and backup setup against the patterns in this report and give you a plain English order of work. No obligation, no jargon.

Book a security risk review 07 3114 2808