Double and Triple Extortions When Encrypted
The month of September saw the rise of ransomware, cyber crimes, and vendor exploits. Travel and supply-chain interruptions represent less common threat actors launching over 400 ransomware campaigns, with exploits available for common hardware and software vendor titan, Cisco, to put a bow on the month. The United States is under attack. In September 2025, Qilin group remains the #1 threat group, known to have attacked as recently as June of this year, a fact that our ransomsecurity.com cyber security team knows all about. In our recent recovery effort, Qilin Group was not only successful in disrupting and stealing from the business but quite scary by setting the desktop wallpaper of our client to dreadful pictures, plus the bitcoins demand.
Notable attacks, impacts, and crimes of the month
Europe reported numerous flight delays on September 20th following a cyberattack that disrupted the Collins Aerospace MUSE traveler boarding systems. This results in the inevitable traveller frustration and loss of confidence in airlines and staff. It is impossible to quantify the damage to business in thousands of stranded business travelers and employees.
Third-party risk continues to rear its ugly face with another incident wherein a supplier is said to have compromised 430,000 customer records, admitted Harrods. The worst of the worst: ransomware is terrible; yet, data breach and confidentiality loss result in monitoring of customers and employees’ credit for years and thousands of lost revenue and renewed operating expenses. This is becoming more and more common with millions of Americans receiving emails and letters letting them know, yet again, their data has been leaked.
Volvo Group officially confirmed an exposure of employee data due to a third-party ransomware incident-a sign that such supply-chain attacks can transcend records even for human resources purposes. How safe then would you say your small business is, with the biggest companies having exploited IT budgets that you cannot even imagine? Volvo, being a household name outside of automotive circles, is global business finally having its confidence shattered.
Trends in Ransomware
The month of September saw 402 ransomware attacks occur across the world, as per Trustwave’s dataset. The Qilin and Akira groups were the most active, with manufacturing and the government sectors fragmented as victim groups. Such is the trend for ransomware and especially when Cryptocurrency demand remains trending and terrifyingly effective as a pay-or-else model for businesses which do not have business continuity put into place.
Our technical team makes use of WORM immutable, offsite backups with complex scheduling mechanisms of high reliability ensuring minimum downtime, generally as fast as the duration required between failovers and the DNS cache clearing.
Urgent Vulnerabilities
- Cisco devices: An emergency directive issued by CISA on September 26 required agencies to patch and hunt for compromised network devices. This communication had been disseminated to SMBs, which, as usual, have turned a blind eye.
- GoAnywhere MFT (CVE-2025-10035): This GoAnywhere MFT exploit has been trending throughout September and has caused data leakages and transfers, usurped for Ransom or at worst some reputation damage. This type of vulnerability, so commonplace in evolving cyber crimes, is termed “common” by ransomsecurity.com. The moment your data is in the hands of the offenders, they have your business.
- DELMIA Apriso (CVE-2025-5086): Added to the Known Exploited Vulnerabilities catalog on September 11th, this flaw affects manufacturing and logistics platforms. This is observed impacts in not just computer systems, but specifically PLCs, CNCs, and other interfaces. Preventable, avoidable, ignored, it is too common and is putting us in a reactive state.
Patch Tuesday
On September 9th, days after Microsoft rolled out patches for 80+ vulnerabilities, Apple and Google had to rush to patch zero-day vulnerabilities, making the month of September a very busy one for urgent patching. When the biggest tech companies are reacting at this volume, we’re all in the firing line. As an MSP, we also provide gold images on stable OS and tight restrictions on user input and action, making these updates mostly unnecessary and manually patching for our specific golden-image for the business. Another good example: We don’t run Windows Update in a traditional sense for our Dental Practice clients; their windows highly restricted serving POS independent of their patient and business management software with no internet connectivity save for our VPN SSL Tunnels into infrastructure management. There is no Spotify or Facebook for their workers.
Key Numbers
- 402 ransomware cases worldwide have been confirmed.
- 430,000 Harrods customer records were exposed.
- Imagine having 80+ Microsoft vulnerabilities patched.
- Three noted additions were made to the CISA KEV list.
What this Means for You
September thus reaffirmed the need for:
Know who the threat actors are; question your IT directors, and do not shy away from second opinions.
Immediate patching of Cisco and MFT systems. It is a vendor emphasis; please do not ignore.
Monthly Disaster Recovery failover exercises and immutable backup recovery.
Never be wary of any phishing with employee education, appropriate admin controls, and proper isolation.
Perform your cybersecurity audits; double down with third-party external validation.
Double extortion means the attacker encrypts your systems and also steals data. The pressure is not only downtime. It includes exposure risk, legal risk, regulatory risk, and damage to customer trust.
Triple extortion adds a third pressure point beyond encryption and data theft. This often includes threats against customers or partners, repeated attacks, or additional disruption such as denial-of-service activity to force payment.
Not always, but you should assume it is possible until proven otherwise. Many ransomware groups exfiltrate data first and encrypt later. You verify this by reviewing firewall logs, endpoint telemetry, cloud audit logs, and any evidence of bulk data staging or outbound transfers.
Attackers often provide samples, screenshots, directory listings, or small file drops. Proof samples do not equal full disclosure. You still need a technical assessment to determine what actually left your environment.
Paying does not guarantee deletion, silence, or functional decryption. It also does not prevent future targeting. The priority is containment, regaining control of identity, and restoring clean systems. The decision to pay is a separate legal, insurance, and business decision.
Stop the spread, preserve evidence, and determine whether identity systems, backups, and cloud tenants are compromised. Do not rush restores until you confirm you are not restoring into attacker access.
Reduce what attackers can reach in the first place. Least privilege access, network segmentation, hardened admin paths, and immutable backups limit both downtime and extortion leverage.
Preserve endpoint logs, server logs, firewall and VPN logs, cloud audit logs, timelines, and all attacker communications. Maintain clean chain-of-custody and do not destroy systems before evidence capture.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!