Automated Hacking Meets Hands-On Intrusions: What Southwest Florida Businesses Need to Defend Now

On October 8, 2026, the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency and international partners released a detailed warning about a model of cyberattack that should concern every small and midsize organization: use automation to find exposed systems at scale, then put skilled operators on the most promising targets.

The advisory attributes the activity to Chinese government-linked threat actors enabled by Integrity Technology Group, a China-based company with government ties. The agencies observed a combination of automated scanning, large botnets, virtual private network infrastructure, exploitation tools and “living off the land” techniques. The attackers targeted government, manufacturing, healthcare, public health and information technology organizations, along with law enforcement, education and religious organizations.

This is not a reason for a Southwest Florida business owner to assume that a foreign government has singled out the company. It is a reason to recognize how modern intrusion economics work. Automation makes it inexpensive to search the whole internet for a forgotten firewall, vulnerable website, weak Microsoft 365 account or open remote-access service. Once a scanner finds an opening, a human operator can investigate the environment, establish persistence and steal the information that has value.

The practical lesson is simple: a business does not need to be famous to be discovered. It only needs to be exposed.

What the advisory says in plain language

The 58-page joint advisory, designated AA26-281A, describes a full attack path rather than a single software flaw.

First, the actors scan the internet. They use widely available tools to identify websites, servers and network services that may be vulnerable. The recovered toolset included more than 1,300 penetration-testing scripts designed to check technologies such as WordPress, OpenSSL, Jenkins, Apache Struts, Oracle WebLogic and Juniper ScreenOS.

Second, they exploit an opening. The advisory documents cross-site scripting attacks, exploitation of known vulnerabilities and password spraying against Microsoft Exchange and Office 365 interfaces. Password spraying is the practice of trying a small number of common or likely passwords against many accounts, which can avoid some traditional lockout thresholds.

Third, they blend in. The actors installed legitimate VPN software for persistent remote access, used ordinary command-line tools such as PowerShell, and renamed programs to resemble familiar Windows files. These are examples of living off the land: using legitimate or expected capabilities in ways that support an intrusion. Security software looking only for a clearly malicious file can miss this behavior.

Fourth, they collect valuable data. The advisory says the actors accessed email, calendars and contacts through Microsoft Exchange Web Services, copied sensitive Active Directory information, and automated the extraction of Microsoft Outlook 365 email. In some cases, they used legitimate access methods, making the activity harder to distinguish from normal administration.

Finally, they maintain options. An intruder who keeps quiet access may return later, steal additional data, use the victim as infrastructure, or move toward a connected customer, vendor or cloud service.

That combination—machine-speed discovery followed by human judgment—is what makes the warning especially important.

Why a Southwest Florida SMB can be part of the target set

Federal advisories often use the language of “critical infrastructure,” but the affected ecosystem is much broader than large utilities and government agencies. Small and midsize businesses frequently operate the systems, supply chains and professional services on which larger organizations depend.

Relevant local examples include:

• A medical practice with protected health information, connected diagnostic systems and cloud email.
• A manufacturer with remote access to production equipment and relationships with larger suppliers.
• A construction, engineering or property-management company holding building plans, access credentials and payment information.
• A law firm, accounting practice or financial-services business with privileged client documents.
• A nonprofit, church or school with lean IT staffing, donor records and Microsoft 365 accounts.
• A hospitality business with cameras, point-of-sale systems, building controls and third-party support connections.
• An IT provider whose credentials and remote-management tools could provide access to multiple customers.

Attackers may value the organization’s own email, contracts, credentials and customer data. They may also value its trusted relationships. A compromised mailbox can support invoice fraud. A compromised vendor account can become a route into a larger customer. A compromised router, camera or network-storage device can be used to hide traffic directed at someone else.

In other words, “we are too small to be targeted” confuses targeting with discovery. Automated discovery is indifferent to company size.

The Microsoft 365 connection

For many Southwest Florida businesses, Microsoft 365 is the operating center for email, files, calendars, identity and collaboration. That concentration creates efficiency, but it also means an account compromise can have an outsized business impact.

The joint advisory describes several paths relevant to Microsoft environments:

• Password spraying and password guessing across Microsoft Exchange interfaces.
• Use of Exchange Web Services to reach email, calendars and contacts.
• Automated access to Outlook 365 mailboxes using configuration data such as a client ID, tenant ID and secret.
• Collection of Active Directory credentials and trust information.
• Use of legitimate access methods that may look less suspicious than commodity malware.

Multifactor authentication is essential, but it should not be treated as the entire control set. Organizations also need to know which authentication methods are allowed, which legacy or unused interfaces remain enabled, which applications have access to mail and files, where administrative roles are assigned, and whether logs are retained long enough to investigate.

A useful Microsoft 365 review should answer at least these questions:

1. Is strong MFA enforced for every user, administrator and remote-access account?
2. Are administrators using separate privileged accounts instead of their daily email identities?
3. Are legacy authentication and unused mail protocols disabled wherever possible?
4. Which enterprise applications and service principals can read mail, files or directory data?
5. Are application secrets and certificates inventoried, scoped and rotated?
6. Are suspicious sign-ins, impossible travel, unusual mailbox access and risky OAuth grants monitored?
7. Are audit logs retained and exportable for incident response?
8. Can the organization quickly revoke sessions, disable an account and preserve evidence without destroying the investigation?

If no one can answer these questions with evidence, the business has a visibility problem even if it owns good security licenses.

Edge devices deserve first-class security attention

Firewalls, VPN appliances, routers, web gateways, network-attached storage and other internet-facing devices sit at the edge of a network. They are often the first systems an outside scanner encounters—and among the least monitored.

The CISA announcement accompanying AA26-281A says the actors targeted edge devices that organizations did not closely monitor. The advisory recommends disabling unused services and ports, patching software and firmware, replacing end-of-life products, reviewing perimeter firewall changes and assessing the public attack surface.

This matters in Southwest Florida for an additional operational reason. During hurricane preparation and recovery, businesses depend heavily on remote access, alternate locations, cloud services and vendor support. A rushed exception created for emergency access can become permanent. A firewall may remain in service long after its support period because replacing it seems disruptive. A temporary vendor account may never be removed.

Resilience and security have to be designed together. The company should be able to operate during a storm without leaving broad, unmonitored administrative access open to the internet.

“Living off the land” changes what defenders must watch

Traditional security thinking often imagines an attack as an obviously bad program entering the network. Living-off-the-land activity is harder because the attacker may use tools that administrators use every day.

PowerShell can automate legitimate Windows administration. A VPN client can enable lawful remote work. Command-line utilities can maintain servers. Microsoft APIs can connect approved applications to email. None of those tools is malicious by itself.

The signal comes from context:

• Who ran the tool?
• From which device and location?
• At what time?
• Was the action normal for that identity and system?
• Did a new service appear or start automatically?
• Did a workstation suddenly upload an unusual volume of data?
• Did an application begin reading many mailboxes?
• Did an edge device configuration change without an approved ticket?

This is why prevention alone is insufficient. The business needs usable logs, a baseline of normal activity, alerting with appropriate context, and a person who can investigate.

Where AI can help—and where it cannot be trusted alone

AI can make a small security team more effective when it is used as an analyst’s assistant, not an unsupervised decision-maker.

Useful applications include:

• Correlating firewall, identity, Microsoft 365 and endpoint alerts into a readable incident timeline.
• Summarizing large log sets and highlighting deviations from a user’s or device’s normal pattern.
• Comparing an asset inventory against current vulnerability intelligence and recommending a risk-ranked review queue.
• Drafting detection queries for behaviors described in a government advisory, subject to testing and approval.
• Translating technical findings into an executive summary, operational checklist or tabletop-exercise scenario.
• Identifying gaps between written security policies and observed configurations.

AI also has important limits.

It can misinterpret normal administrative behavior, invent explanations, or assign false confidence to incomplete data. Automatically blocking an IP address merely because an AI model calls it suspicious can disrupt a legitimate vendor, traveling employee or disaster-recovery connection. Automatically isolating a server without understanding its business function can turn a contained security event into an outage.

Human judgment is required to validate evidence, understand business impact, authorize containment, meet regulatory and contractual obligations, and decide when to involve counsel, insurance, law enforcement or affected customers. Sensitive security logs and incident data also should not be pasted into an unapproved public AI service. The organization needs a defined AI-use policy, appropriate data protections, access controls and an audit trail.

AI can shorten the distance from signal to understanding. It does not replace accountable decision-making.

A practical 72-hour response for business leaders

This advisory does not mean every organization is compromised. It does justify a focused check of the systems most likely to be discovered or abused.

1. Confirm the external attack surface

Ask for a current inventory of every public IP address, domain, subdomain, firewall, VPN gateway, remote-management portal and externally reachable application associated with the business. Compare the inventory to what an outside observer can actually see. Include cloud resources and vendor-managed systems, not just equipment in the main office.

Any asset that has no named owner should be treated as a finding.

2. Close what does not need to be open

Disable unused services, ports, management interfaces, file-sharing protocols and old remote-access paths. Restrict necessary administration to approved sources or a secure access layer. Remove test systems and abandoned subdomains from public exposure.

3. Check edge-device support and patch status

Verify the model, firmware, support status and last configuration review for every firewall, router, VPN appliance and network-storage system. Patch supported devices using trusted vendor channels. Build a replacement plan for end-of-life equipment rather than accepting permanent exposure.

4. Review identity and Microsoft 365 controls

Confirm MFA coverage, conditional-access policies, administrator separation, stale accounts, enterprise application permissions, application credentials and suspicious sign-in alerting. Look for accounts or applications accessing more mail or files than their role requires.

5. Preserve and review logs

Ensure the organization is collecting edge-device, identity, Microsoft 365, Active Directory, endpoint and key application logs. Confirm retention is long enough to reconstruct an incident. Search for unauthorized remote-access software, unexpected administrative commands, abnormal uploads, new persistence mechanisms and unusual account activity.

6. Validate backups and recovery

Confirm that critical data and configurations are backed up, separated from production access and protected from modification or deletion by a compromised administrator. Test restoration—not just backup completion. Include firewall configurations, cloud data and essential SaaS records in the recovery discussion.

7. Define escalation before evidence appears

Identify who can authorize isolation of a system, disable an executive account, engage incident-response support and contact cyber insurance. Write down the process and secure an offline copy. A business should not invent its authority structure during an attack.

A 30-day hardening plan

After the immediate review, build repeatable controls rather than a one-time cleanup.

Week 1: Inventory and ownership

• Reconcile internal inventory with external discovery.
• Assign a business and technical owner to each internet-facing asset.
• Document vendor access and support dependencies.
• Remove unsupported, unknown or unnecessary exposure.

Week 2: Identity and privilege

• Enforce strong MFA and reduce weaker fallback methods.
• Separate administrator and daily-use accounts.
• Remove stale users, guest accounts, application permissions and secrets.
• Apply least privilege to Microsoft 365, Active Directory and remote-management systems.

Week 3: Detection and response

• Centralize the logs needed to detect scanning, unusual administrative behavior and data exfiltration.
• Establish normal behavior for privileged identities, remote access and outbound traffic.
• Test alerts for password spraying, suspicious mailbox access, new VPN software and unexpected directory replication.
• Run a tabletop exercise based on an exposed device leading to email theft.

Week 4: Continuity and validation

• Restore a representative server, Microsoft 365 data set and critical network configuration.
• Verify emergency communications and alternate-work procedures.
• Test security controls against relevant behaviors from the advisory.
• Present the remaining risk, remediation owner and due date to leadership.

Questions to ask your IT provider or internal team

Business leaders do not need to master every indicator of compromise. They do need clear, evidence-based answers.

Ask:

1. What can an unauthenticated person on the internet see that belongs to us?
2. Which of those systems have known exploited vulnerabilities or are past end of support?
3. When were our firewalls, VPNs and public applications last independently assessed?
4. Can we detect password spraying across every relevant Microsoft 365 and Exchange interface?
5. Which apps and service accounts can read employee mail or files?
6. Would we alert on a new VPN client, unusual PowerShell activity or unexpected Active Directory replication?
7. How long are the necessary logs retained, and who reviews them?
8. Can a compromised administrator delete or encrypt our backups?
9. When did we last restore critical data and network configurations?
10. What happens in the first hour if a trusted account appears compromised?

“We have a firewall,” “we use MFA,” or “our provider handles that” are descriptions of products and relationships—not proof that the controls work.

How Managed Intelligence Advisors can help

Managed Intelligence Advisors helps Southwest Florida organizations turn a broad government warning into a prioritized, business-specific plan.

An engagement can include:

• External attack-surface discovery and ownership mapping.
• Firewall, VPN, remote-access and edge-device lifecycle review.
• Microsoft 365 identity, application-consent, mail-access and audit review.
• Vulnerability prioritization based on active exploitation, exposure and business impact.
• Detection engineering and log-retention assessment for living-off-the-land behavior.
• Vendor and managed-service-provider accountability review.
• Backup, recovery and hurricane-continuity validation.
• Incident-response planning and executive tabletop exercises.
• Responsible AI guidance for security analysis, including data handling and human approval controls.

The objective is not to create fear or sell a pile of disconnected tools. It is to establish what is exposed, what matters most, what the organization can detect, what it can recover, and who is accountable for each action.

If your business cannot produce a current list of public-facing systems, privileged accounts, high-impact cloud applications and recoverable backups, that is the right place to start.

Suggested call to action: Request an Internet-Exposed Asset, Identity and Living-off-the-Land Readiness Review from Managed Intelligence Advisors.

The bottom line

The October 8 advisory shows why modern cybersecurity is no longer a choice between defending against automation or defending against a skilled human attacker. Businesses have to prepare for both.

Automation lets an adversary find forgotten systems and weak accounts across the internet. Human operators decide which openings are worth pursuing and how to blend into legitimate activity. The most effective response is therefore layered: reduce exposure, patch and replace vulnerable edge systems, strengthen identity, monitor behavior, segment access, protect backups and rehearse the decisions that people must make under pressure.

For Southwest Florida businesses, these are also continuity controls. The same visibility and discipline that reduce the chance of email theft or persistent access make it easier to operate through a storm, a vendor outage or an ordinary equipment failure.

Security is strongest when technology, operational resilience and accountable human judgment work together.