September was a busy month for attackers. Here is a quick look at what stood out, and what to do about it this week.
1. Ransomware is still climbing
Check Point Research counted 824 publicly reported ransomware attacks in September, 53% more than in September 2025. North America accounted for 46% of them, and Canada for 3.6% of victims worldwide. Other trackers count slightly fewer (ThreatMon logged 762), but they all show the same trend: volume is well above last year.
The most active groups were The Gentlemen, Qilin and Akira. The Gentlemen and Akira both build attacks that can hit Windows, Linux and ESXi virtualization hosts, so a mixed environment is not a safeguard. Business services firms were the most targeted industry, at just over 31% of victims. That makes sense: a company that holds data or system access for its customers is a good way to reach many of them at once.
2. Unpatched software is the front door
Several of the month's serious incidents started with a known flaw that had not been patched yet:
- Ransomware gangs began exploiting a critical VMware vCenter flaw, according to a CISA warning in mid-September.
- Attackers exploited recently patched PaperCut print server vulnerabilities to steal data.
- A critical JetBrains TeamCity flaw was used by ransomware groups late in the month.
- Apple patched an actively exploited zero-day that affects iPhone, iPad and Mac.
The common thread is time. The gap between a patch being released and attackers using the flaw keeps shrinking.
3. Phishing is on the rise
About 1 in 91 emails was classified as phishing in September, up from about 1 in 112 in August. In North America it was closer to 1 in 79. Most of those emails (81%) relied on a link rather than an attachment, so what users click matters more than what they open.
4. Staff are pasting company data into AI tools
Check Point also found that roughly 1 in 39 prompts sent to business AI tools carried a high risk of leaking sensitive data, across 89% of the organizations that use these tools regularly. Network and IT infrastructure details, such as configurations and IP addresses, were the most common type of data exposed. That is exactly the information an attacker would like to have.
5. Attackers are borrowing IT tools
A new ransomware variant called Settra was reported in retail and manufacturing attacks. It was observed using remote management (RMM) tools, the same kind IT providers rely on, along with techniques that disrupt recovery. Any remote access you have set up needs to be locked down and monitored.
What to do this week
- Patch. Update servers, virtualization hosts, firewalls, and all Apple and Windows devices. Anything reachable from the internet comes first.
- Turn on multi-factor authentication for email, remote access and admin accounts.
- Test your backups. Make sure you have a copy that attackers cannot reach, and do an actual restore to confirm it works.
- Remind your team about phishing. Check the link before clicking, and confirm unusual payment or password requests by phone.
- Set a simple AI-use rule. No customer data, passwords or network details go into public AI tools.
- Review remote access. Know who and what can connect, and remove anything you no longer use.
If you would like help with any of this, see our pages on ransomware protection, secure remote access and managed services, or get in touch for a conversation about your setup.
Sources: Check Point Research, September 2026 Cyber Threat Landscape; ThreatMon, September 2026 ransomware report; Synergy IT, September 2026 incident roundup; CM-Alliance, September 2026 incident roundup.