On the surface, this week's security stories look unrelated: a law enforcement seizure of criminal hosting infrastructure, a Chinese state-sponsored espionage campaign, a telecom data breach, a social platform's indexing change, and a vendor nudging customers toward passwordless login. Looked at together, however, they describe a single shift that IT and security leaders across the UAE and wider GCC should take seriously -- the boundary between "your" infrastructure and "someone else's" infrastructure is dissolving, and attackers are exploiting exactly that ambiguity.
Criminals rent infrastructure too
US law enforcement has seized the main domain of Virtualine, a "bulletproof" hosting service advertised on cybercrime forums as a safe place to run phishing sites and other illegal operations. Investigators say a significant share of its income came from ransomware and other crime, and more than 3,000 of its customers are being looked at. Takedowns like this disrupt attackers for a while, but they also show how much of today's cybercrime runs on rented servers that can move quickly from one provider to the next.
State hackers hide inside everyday devices
Researchers at Black Lotus Labs found that Volt Typhoon, a Chinese state-sponsored group, has been using a framework called Silent Train. It relays attacks through rotating chains of compromised devices, so the traffic appears to come from ordinary networks rather than the attacker. The group has used it to launch zero-day attacks on communications, defence, education and critical infrastructure targets, including against products from vendors such as Cisco and N-able. Routers, firewalls and management platforms that nobody watches closely are exactly what makes this possible.
Customer data held by service providers
Sony Network Communications, a Japanese internet service provider, confirmed a breach affecting about 2.5 million customer records, including names, phone numbers, email addresses and dates of birth. A further 54,401 email addresses and passwords were exposed. No payment details were taken, but the stolen data is ideal for targeted phishing, and a partner company has already warned customers to expect scam messages.
Conversations becoming public
Discord will let search engines index messages from its larger public servers, with summaries appearing from 16 November and full indexing from mid-December. Server administrators can control the feature. For businesses that run community or support channels on platforms like Discord, information shared there may soon be far more visible than staff expect.
Identity moving to passkeys
Microsoft is again urging administrators to move Entra ID users to phishing-resistant sign-in methods such as passkeys and FIDO2 security keys before it retires SMS and voice authentication for workforce accounts on 1 February 2027. Organisations that still rely on text-message codes have three months to plan the change.
What UAE and GCC organisations should do now
- Know where your data lives. List the hosting, cloud and service providers that hold your systems and customer data, and review their security commitments and breach notification terms.
- Patch and monitor edge and management devices. Keep routers, firewalls and remote management platforms up to date, restrict their management interfaces and watch them for unusual activity.
- Prepare for phishing after third-party breaches. When a provider you or your customers use is breached, warn staff and customers to expect convincing scam messages.
- Review what is public. Check which community, support or collaboration channels are open to the public, and what staff share there.
- Plan your move off SMS codes. If you use Microsoft 365, roll out passkeys, the Microsoft Authenticator app or FIDO2 keys well before February 2027, starting with administrators.
- Block known bad infrastructure. Use firewall and web filtering services with up-to-date threat intelligence so connections to malicious hosting are stopped automatically.
The edge of your network is wider than it looks
Your security now depends on providers, platforms and devices you do not fully control. Knowing which ones you rely on, and making sure each is properly secured and monitored, is the practical way to close that gap.
COMMPRO Technologies supplies Microsoft 365, firewalls and identity security solutions across the UAE and GCC. If you would like help planning your move to passkeys or reviewing your third-party exposure, contact our team.
