A major dark web marketplace operator just got sentenced to 40 years in prison. Forty years. For facilitating hundreds of millions of dollars in illegal transactions and putting ransomware tools into the hands of criminals.

That is not a slap on the wrist. That is a career-ending, life-ending sentence, and honestly, good.

What This Person Actually Did

This was not some low-level hacker. This was the person running the marketplace, the infrastructure that made it easy for criminals to buy and sell ransomware tools and other illegal goods at scale. Hundreds of millions in transactions flowing through one place.

When your business gets hit with ransomware, there is usually a whole supply chain behind it. Someone built the tool. Someone sold it. Someone ran the platform where the deal happened. This prosecution went after one of those platform operators, which is the right move.

Why This Actually Matters

Law enforcement going after the enablers, not just the people pulling the trigger, is a big deal. It is harder to prosecute and takes longer, but it does more damage to the criminal ecosystem than catching one ransomware attacker at a time.

Forty years sends a message to everyone else running one of these platforms that this is not a victimless white-collar situation. You are going to prison for a very long time.

For small business owners, this is just a reminder that the tools being used against you are not coming from nowhere. There are organized operations behind them, and those operations are starting to face real consequences.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

This story caught my attention because it is exactly the kind of thing that happens when your business is already in crisis mode and you are desperate to get your data back.

The owner of a Florida-based ransomware remediation company, a firm called Monster Cloud, is facing federal fraud charges. The scheme was pretty straightforward once you see it. He would come in and tell victims he had the technical expertise to recover their data without paying the ransom. So let’s say the ransomware demand was ten grand. He might charge the victim eight thousand, tell them he’s cleaning it up himself, then go to the attackers and negotiate it down to five. He pockets the three thousand dollar difference and never actually does what he told the client he was doing.

Why This Works on Panicked Business Owners

When ransomware hits, your business is bleeding. Every hour matters. You are not in a great position to carefully vet the company you just called for help. That is exactly when someone like this walks in, sounds confident, and you just hand them the keys.

And here is the part that really gets me: he could have probably made decent money just doing legitimate remediation. He clearly had the skills to pull this off. But instead he ran a fraud operation and now he is looking at federal charges. Not a great career move.

Paying the Ransom Is Not the Whole Problem

Whether you pay through a middleman or directly, paying to get your data back does not mean you are clean. If the ransomware software is still sitting on your systems, they will just encrypt you again. The remediation, actually finding and removing whatever got in, is the part that matters most. That is what you are really paying for, and that is what you need to make sure actually happens.

There is also a real legal risk to paying ransoms directly. The FBI does not look kindly on you sending Bitcoin to what could be an international fraud organization or worse. So do not make a habit of it.

The other thing worth knowing is that the attackers themselves usually do return your data when paid. They have a business model to protect. If word got out that they took the money and gave nothing back, nobody would ever pay them again. That does not make them trustworthy people, but it does mean the ransom payment side of this usually works as advertised. The recovery side is where you can get burned.

Vet Your Recovery Vendor Before You Need One

The best advice I can give you comes out of this story directly: find and vet a recovery vendor now, before anything happens. When your systems are down and your data is locked, you do not have time to research anybody. You will just call whoever comes up first in a search and hope for the best. That is how you end up with a Monster Cloud situation.

• Ask for references from actual clients who went through a ransomware incident with them.
• Understand exactly what they will do technically, not just what they will negotiate.
• Make sure remediation, actually cleaning the infection off your systems, is part of what they are promising.
• Be skeptical of anyone who leads with “we can get your data back without paying the ransom” and then cannot explain how.

If you want help figuring out who to trust for this, reach out and we can talk through it.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Central Florida.

I love pointing this one out. The Pentagon has one of the largest IT security budgets on the planet. And they still got hacked. Over 3 million records, gone.

So if you are sitting there thinking your little business in a small town is flying under the radar, I need you to hear this again, because I have been saying it for years and it is still true.

They Do Not Know Who You Are, and That Is the Problem

The old saying is, “I’m just a small business in a small town, they don’t care about me.” I understand why people think that. But it is wrong, and here is why.

The internet is the ultimate shotgun. These attackers can blast all over the world, hitting thousands of targets at almost no cost. They do not know your name. They do not know your town. They do not know what you do. They are not targeting you specifically. They are targeting everyone, all at once, and seeing what sticks.

If you are not paying attention because you think you are safe, and something slips through, that is on you. Not on them.

Spending More Money Is Not Always the Answer

I am not telling you this to get you to write a bigger check. If the Pentagon can get breached with their budget, throwing money at the problem is not automatically the fix.

What we do need is to have the conversations. Review your access controls. Know what data you have, who can get to it, and how it is protected. That is where this starts. Not with a panic purchase, but with a real look at what you have got.

If you have employees or family members connected to the defense world, a breach like this can also open the door to follow-on phishing. Someone gets your name and email from a leaked HR system and then sends you something that looks completely legitimate. That is the next wave you watch for.

The takeaway is simple: if the Pentagon can get hit, so can you. Have the conversation before something forces you to.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.

There is a widening cybersecurity gap specifically among small and mid-sized manufacturers in the US. And honestly, that does not surprise me at all, because security is expensive and it is a hard lift for small businesses.

Why Manufacturers Get Hit Especially Hard

Manufacturers get it coming and going. You have high labor costs and high capital costs already. Then you add in the cost of keeping your technology secure, and it feels like a lot. But here is the reality: you do not want those machines sitting idle because something got compromised. When a machine goes down because of a security problem, it becomes extremely expensive, extremely fast.

And if you are doing any kind of defense work, the compliance lift is even larger. That is a whole different level of requirement on top of everything else.

Baseline Security Does Not Have to Break the Bank

You do not need a big budget to get protected at a reasonable level. You can do baseline security pretty affordably. Even something like the lean line service we are getting ready to launch here at ACS, which is built around automation, can get you that baseline security without requiring a full managed services contract.

The idea is simple: if you are willing to handle most of the day-to-day IT yourself, we handle the backend automation, the monitoring, the alerts, the backups, and the protection. You get the security foundation without paying for constant hand-holding. And what we have found is that once the automation is in place, you rarely need to talk to anyone. Things just run better.

If you own your own IT, that model still works. We can pull the reports, get the info, and make sure the baseline is covered.

What to Do Right Now

• Do not leave your machines unprotected because full enterprise security feels out of reach. Baseline is achievable.
• Look into what a managed or automated security setup would cost you versus the cost of one day of downtime on your floor.
• If you are doing defense or government work, get help understanding the compliance requirements. That is a bigger conversation, but it is one worth having.

If you want to talk through what baseline security looks like for your shop, give us a call. We can figure out what makes sense for your size and your budget.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.

If your business runs a WatchGuard Firebox firewall, this is the one story you need to stop and read this week.

What’s Going On With WatchGuard

There’s a confirmed vulnerability in WatchGuard Firebox firewalls, and it’s not a minor one. CISA has confirmed that ransomware operators are actively targeting it right now. The flaw allows remote code execution — meaning an attacker on the other side of the world can reach into your device and run their own code on it. That’s about as bad as it gets.

On the CVSS severity scale — that’s the standard scoring system security researchers use to rate how dangerous a flaw is — this one scores a 9.8 or 10 out of 10. As Albert put it on air, “I don’t know if it gets any higher than 10.” WatchGuard is a widely used small business firewall. There are hundreds of thousands of these devices out there, which means the attack surface is enormous.

WatchGuard has been issuing vulnerability alerts, and patches are available. The problem is that a lot of businesses either don’t know about the flaw, haven’t applied the fix yet, or — and this is the part that really matters — have their management interface exposed directly to the open internet, which is exactly what the attackers are looking for.

What Ransomware Actually Does to Your Business

Here’s the part that gets glossed over when people talk about ransomware. The first wave of ransomware was bad enough — attackers would encrypt your data and hold it hostage until you paid up. But that’s not what’s happening now. Today’s ransomware gangs encrypt your data and pull it out of your network. They exfiltrate it. Then they have two ways to squeeze you: pay to get your data back, or they release it publicly.

That’s your customer records. Your financials. Your contracts. Even if you restore from backup and never pay a dime, the fact that a breach happened is blackmail material on its own. And if you’re a manufacturer, add production downtime on top of that. The average ransomware hit costs a small business between $40,000 and $50,000. That’s not a number most businesses under 100 employees can just absorb and move on from.

The villain here isn’t some abstract hacker — it’s a known, patchable vulnerability sitting in a device that’s probably been humming along in your server closet without anyone checking it in months. That’s the real risk. Not the unknown. The ignored.

The Specific Thing That Makes You a Target

The attack path here is pretty specific, and it matters. The question you need to answer is whether your WatchGuard management interface is reachable from the open internet. If it is, you’re in a much more exposed position than you should be.

This is a pattern Albert keeps seeing across these security situations — the management interface gets left open to the web, and that becomes the door attackers walk through. The right answer is to have that interface completely off the public internet. If you absolutely need remote access to it, it should be locked behind a VPN — not just sitting out there with a login page anyone can reach. And even MFA on an exposed management interface isn’t enough. It’s better than nothing, but it’s not the fix.

What To Do This Week

• Find out if you have a WatchGuard Firebox. If you’re not sure, ask whoever manages your IT. This is not the week to let that question sit unanswered.
• Check whether your management interface is exposed to the internet. Your IT person or MSP can tell you in about five minutes. If it is open, that needs to change — either close it off entirely or put it behind a VPN before anything else.
• Apply the available patches immediately. WatchGuard has issued updates. If your device isn’t current, get it patched. If you’re on a managed IT plan, confirm with your provider that this has been addressed on your specific device.
• If you’re not sure where you stand, call your MSP this week. As Albert said, “Give me a call and I’ll tell you what’s going on with it — whether you’re at risk or not — and fix it if you are.” That’s the whole job. You shouldn’t have to figure this out alone.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.

If your business is still running an on-premises or hybrid Microsoft Exchange server, this is the one thing you need to check this week.

What’s Going On With Exchange Right Now

Nearly 22,000 Microsoft Exchange servers are sitting out there right now, unpatched against a critical authentication bypass vulnerability. That means an attacker doesn’t need your password, doesn’t need to trick your employees, and doesn’t need to be particularly clever. They just walk in. The flaw lets them take over user mailboxes directly.

And this isn’t some theoretical risk buried in a security research paper. This is a known, documented vulnerability with a patch available — and tens of thousands of businesses just haven’t applied it.

The article also flagged something worth paying attention to: some businesses think they’re off the hook because they moved to Microsoft 365. But if you have any on-premises Exchange functionality still running in a hybrid setup, you may still be exposed. The cloud subscription doesn’t automatically close the door on the server sitting in your back office.

What This Means for Your Business

Albert put it plainly: leaving your Exchange server unpatched is like leaving the doors open, the windows open, and announcing you’re not home for the next week. That’s not a stretch. An authentication bypass at the mailbox level means an attacker can read email, send email as your employees, access attachments, and potentially use that foothold to move deeper into your network.

For a small business — under 100 employees, one IT person or none at all — a compromised email server isn’t just an inconvenience. It can mean exposed client data, fraudulent wire transfers initiated from a spoofed inbox, or a ransomware payload delivered straight to your team. And this came up right alongside a separate story about a days-long Microsoft 365 outage that cost some businesses an estimated $150 per employee per 10% drop in productivity. Email going down hurts. Email getting hijacked is a different category of problem entirely.

The villain here isn’t some shadowy hacker genius. It’s an unpatched server that’s been sitting there, quietly, while the fix has been available. That’s the part that stings — this one is preventable.

What To Do This Week

• Find out if you’re running Exchange on-premises or in a hybrid setup. Ask your IT person directly: “Do we have any Exchange servers running locally, or any on-premises Exchange components tied to our Microsoft 365 account?” If they hesitate or aren’t sure, that’s your answer — you need to dig in.
• Confirm your Exchange servers are fully patched. The specific patch for this authentication bypass needs to be applied. Don’t assume it happened automatically. Exchange servers typically require manual patching, and “we haven’t had problems” is not the same as “we’re protected.”
• If you’re running pure on-premises Exchange, seriously consider the move to Microsoft 365. Albert’s take was straightforward: get off Exchange and get onto Microsoft 365. A fully cloud-hosted setup eliminates this entire category of exposure. It’s not always a fast migration, but it’s worth starting the conversation now.
• If you’re hybrid, audit what’s still living on-premise. Some businesses migrated most of their email to the cloud but left Exchange components running because nobody got around to decommissioning them. If that’s you, those leftover pieces still carry risk and still need to be patched or removed.

The good news is that none of this requires a major project to get started. A quick conversation with your IT provider — or a 30-minute audit of what’s actually running on your network — can tell you exactly where you stand. Knowing is the first step to being in control of this instead of reacting to it after something goes wrong.

Don’t wait on this one. The patch exists. The vulnerability is known. The only variable right now is whether your server is on the list of 22,000 exposed ones — or not.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Chicagoland.

PaperCut NG and MF have a vulnerability being actively exploited — and if you are running this print management software on your shop floor, your print servers need attention this week.

What Is Going On With PaperCut

PaperCut NG and MF are print management platforms. A lot of manufacturers use them to handle shipping labels, job tickets, and work-in-process documents. If your team prints anything on the floor — and most manufacturers do — there is a real chance this software is somewhere in your building.

Here is the part that should get your attention: this is not the first time PaperCut has had a serious problem. Back in 2023, a vulnerability hit over 70,000 organizations globally. Shipping labels were compromised, servers were hit, it was a mess. And now they are back with another one. That track record is not what you would call a confidence builder.

Confirmed incidents are already underway. This is not a theoretical risk sitting on a security researcher’s whiteboard somewhere. Attackers are using this flaw right now.

Why This Matters More If You Are a Manufacturer

Albert put it plainly: manufacturers print stuff. The shipping department prints stuff. The floor prints work orders, job tickets, process documents. It is just how manufacturing runs. And that means PaperCut is sitting right in the middle of your operation, connected to servers that touch a lot of other things.

A compromised print server is not just a nuisance. It is a door. Once an attacker is inside that server, they have a foothold in your network. And if you are doing any kind of government contract work — Department of Defense, anything regulated — this is not a problem you can let sit. The exposure goes well beyond a jammed printer.

The villain here is not complicated. It is a known, patchable flaw that attackers are already using, sitting on a server your team probably has not thought about since it was set up. That is exactly the kind of quiet risk that turns into a very loud, very expensive problem.

What to Do About It This Week

• Find out if PaperCut is in your environment. Check with whoever manages your print servers. If you are not sure, that is itself a problem worth solving. You should know what software is running on your network.
• Contact your PaperCut vendor relationship directly. Ask them specifically about this vulnerability and what patch or mitigation is available. Do not wait for them to reach out to you — they probably will not.
• Get your IT provider involved immediately. As Albert said, the article does not spell out every technical step, but your IT team should be on this. If they are not aware of it yet, send them this. Getting it patched and fixed as soon as possible is the move.
• If you are in a regulated industry, treat this as urgent. Government contract work, defense manufacturing, anything with compliance requirements — do not let this one linger. The cost of a breach in those environments is not just downtime. It is your contracts.

The Bigger Picture Here

There is a conversation that comes up a lot with small businesses: we are small, we have limited resources, security is expensive and hard — how are we supposed to keep up with this stuff? It is a fair question. Albert made the point that even the federal government, with its enormous budget, gets hacked. The ATF was in the news for exactly that this week.

But that is not a reason to give up. It is a reason to have the right people watching your environment. The businesses that stay ahead of things like the PaperCut situation are not the ones with the biggest budgets — they are the ones that have someone paying attention. Someone who catches these things before they become incidents.

If you have been running your print environment on autopilot, this is a good week to change that. A print server feels like background noise. But it is still a server, it is still on your network, and right now there are people actively looking to exploit exactly this kind of overlooked corner of your infrastructure.

Get it patched. Get it checked. Do not let a print management platform be the reason you have a very bad week.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Federal agencies put out a warning that threat actors are using artificial intelligence to build exploits aimed straight at Siemens S7 programmable logic controllers.

What Happened

Albert Steed covered this on the show as the second story. The attacks are moving from the usual office computers to the actual machines that run production lines.

The agencies say the bad actors are now crafting sophisticated exploits with AI help. The target is the Siemens S7 line of controllers that lots of factories still run.

Albert put it plain: AI-powered attacks are now targeting shop floor machines. That shift matters because these controllers were never built to fend off that kind of smart probing.

What This Means for Your Business

The villain here is the same one that keeps showing up: downtime and the unknown breach that stops your line cold. When the controller that runs a press or conveyor gets hit, you lose hours or days while you figure out what broke and how to fix it.

Small shops already run lean. You do not have a team watching every PLC log. If an AI-crafted attack slips through, the cost shows up fast in lost production and the scramble to get running again.

What To Do This Week

• Walk the floor and list every Siemens S7 controller still in use.
• Check with your equipment vendors for any firmware updates that address these new AI-driven exploits.
• Make sure the network segments that touch those controllers are isolated from the rest of your systems.
• Run a quick test to confirm your backups cover the PLC logic so you can reload fast if something goes wrong.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.

These scammers are going after anyone who’s had ransomware or even thinks they might have it.

What Happened

A fake recovery firm called Ransom Busters is contacting ransomware victims and posing as a legitimate decryption service. They take the recovery payments and run.

The transcript makes it clear these guys are targeting people right when they’re most vulnerable. Either the business already has ransomware, or they’ve got reason to worry they might.

What This Means for Your Business

The villain here is the extra layer of theft on top of an already bad situation. You pay to get your files back and end up out even more money with nothing to show for it.

That leaves you reacting instead of in control, and the cost adds up fast when you’re a small service or manufacturing outfit trying to keep operations running.

What To Do This Week

• Check any recovery company that contacts you by looking up their real address and reviews outside email or phone.
• If you’ve had ransomware, talk to your team about who handles payments and make sure no one sends money without a second check.
• Mark the August grant deadlines on your calendar since you’ve only got about 11 days left for those small service and manufacturing programs.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.

Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Central Florida.

Ransomware took down 1,140 factories in Q2. That is a lot of lost productivity in one of the most important parts of the economy.

The Scale of the Problem

A report from Dragos counted 1,140 ransomware incidents aimed at industrial manufacturers. That works out to about 12 attacks every day. Manufacturers took the biggest share with 747 of those hits.

The odd part is how these attacks stopped production without laying a finger on the actual machines on the floor. The report does not spell out the exact method, but the result is the same: lines go quiet and orders stop moving.

Why This Hits Small Manufacturers Hard

Downtime is the real villain here. When a ransomware crew locks up the systems that run scheduling, inventory, or shipping, your team sits idle even if the presses and robots are still in one piece. Every hour of that adds up fast in a business that already runs on tight margins.

Most owners do not have a room full of security analysts watching the network. You are left reacting after the fact, which keeps you behind and guessing what might break next.

Steps You Can Take This Week

• Walk through your current backups and make sure at least one full copy sits completely offline and cannot be reached from the main network.
• List every person and vendor who has remote access to your systems, then cut the accounts that no longer need it.
• Check whether your shop-floor machines or control systems can keep running for a short time if the main office network goes down.
• Run a quick test of restoring a single file or folder from backup so you know the process works before you actually need it.

Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.