Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their Tactics
Summary
CYFIRMA recorded 862 ransomware victim postings in September, down 26.3% from August. Its monthly report highlights shared affiliate toolchains, RMM and tunnel abuse, cloud data theft, BYOVD, and attacks on recovery and cloud systems.
Key points
- The tracker counted 862 publicly disclosed victims in September, 26.3% fewer than August’s 1,170; the United States accounted for 324 postings.
- Thegentlemen led tracked groups with 105 postings, followed by Qilin with 74; Safepay and AuditTeam were among the strongest risers in the top ten.
- Professional services, healthcare, manufacturing, real estate and construction, consumer goods, and IT were among the most targeted sectors.
- The report describes affiliates reusing toolchains across ransomware brands, with legitimate RMM products and outbound tunnels supporting remote access and persistence.
- Rclone and s5cmd were used in reported activity to move data to cloud object storage before encryption, supporting double extortion.
- Reported tactics included BYOVD to impair endpoint defenses and ransomware disabling Windows recovery features or removing recovery partitions.
- The report recommends hardening exposed RMM and Fortinet systems, strengthening identity controls, monitoring cloud and tunnel activity, and maintaining immutable or offline backups.
Article Details
- Publisher
- CYFIRMA Research
- Report Period
- September 2026
- Scope
- CYFIRMA leak-site tracker activity and ransomware threat reporting for September 2026.
- Sample Size
- 862 victim postings recorded across tracked data-leak sites; the tracker does not record victim organization size.
- Key Statistics
- The tracker recorded 862 publicly disclosed ransomware victims in September 2026, down 26.3% from 1,170 in August.
- Thegentlemen led September leak-site activity with 105 postings, followed by Qilin with 74.
- The United States accounted for 324 incidents, or 38% of the September total; 90 countries were identified as affected.
- Professional Goods & Services had 127 tracked victims, the highest September industry count.
- A cited 2022 Cybereason study reported that approximately 31% of surveyed organizations suspended operations temporarily or permanently after a ransomware attack.
- Recommendations
- Inventory authorized RMM tooling and alert on new installations outside change windows and unexpected coexistence of multiple RMM products.
- Detect unauthorized outbound tunnels, new cloudflared or ngrok services, and scripts that enable TCP 3389 or alter firewall policy.
- Alert on s5cmd and Rclone execution, unexpected AWS credential files, and unapproved bulk outbound object-storage transfers.
- Remove public exposure of N-able N-central and other RMM consoles; patch applicable vulnerabilities and rotate administrative sessions and API tokens.
- Patch FortiOS and FortiProxy for CVE-2024-55591 and CVE-2025-24472, invalidate existing administrative sessions, and assess exposed appliances for compromise.
CVE
CVE-2023-20598malware research on Lunex loaders compiled mid-September documented abuse of AMD PDFWKRNL.sys (CVE-2023-20598) to zero kernel notify callbacks after resolving offsets via Microsoft PDB downloads.CVE-2024-55591Police Agency (KNPA) warned that Gunra operators exploit FortiOS and FortiProxy issues, including CVE-2024-55591 and CVE-2025-24472, to obtain super-admin rights, bypass MFA assumptions on edge appliances, andCVE-2025-24472warned that Gunra operators exploit FortiOS and FortiProxy issues, including CVE-2024-55591 and CVE-2025-24472, to obtain super-admin rights, bypass MFA assumptions on edge appliances, and progress intoCVE-2026-18556in the top-ten chart) highlighted exploitation of N-able N-central authentication bypass flaws in the CVE-2026-18556 / CVE-2026-18577 family, converting unpatched internet-facing RMM admin planes into fullCVE-2026-18577highlighted exploitation of N-able N-central authentication bypass flaws in the CVE-2026-18556 / CVE-2026-18577 family, converting unpatched internet-facing RMM admin planes into full administrative footholds.
Threat Actors
AiLockAugust-active ransomware brand with 4 postings and no September victims in the tracker.AkiraRansomware brand with 36 September 2026 victim postings.AnubisRansomware ecosystem named in reporting on deployments involving Storm-2570.AuditTeamRansomware brand with 25 September 2026 victim postings.BlackLocksNewly observed or returning leak-site brand with 3 September victim postings.Cl0pRansomware brand with 25 September 2026 victim postings.CoinbasecartelAugust-active ransomware brand with 24 postings and no September victims in the tracker.DeadlockAugust-active ransomware brand with 6 postings and no September victims in the tracker.DragonForceRansomware ecosystem named in reporting on deployments involving Storm-2570.EndZoneNewly observed or returning leak-site brand with 5 September victim postings.fulcrumsecRansomware brand with September leak-site activity; the article reports 2 victim postings.GunraRansomware operators reportedly exploited FortiOS and FortiProxy vulnerabilities for access and double extortion.HelixAugust-active ransomware brand with 8 postings and no September victims in the tracker.incransomRansomware brand with 29 September 2026 victim postings; the article says INC Ransom affiliates deployed BYOVD packages.JADEPUFFERAlternate name explicitly given in the article for Storm-3168, which it describes as conducting automated Azure tenant abuse.KrybitRansomware brand with 34 September 2026 victim postings.L GroupAugust-active ransomware brand with 28 postings and no September victims in the tracker.lamashtuNewly observed or returning leak-site brand with 10 September victim postings.LynxAugust-active ransomware brand with 3 postings and no September victims in the tracker.N0nNewly observed or returning leak-site brand with 18 September victim postings.NasirsecurityAugust-active ransomware brand with 4 postings and no September victims in the tracker.NetrunnerRansomware brand with September leak-site activity; the article reports 2 victim postings.QilinRansomware brand with 74 September 2026 victim postings; also named in affiliate deployments involving Storm-2570.SafepayRansomware brand with 32 September 2026 victim postings.SettraRansomware brand with 23 September 2026 victim postings; a September variant was reported to stage MeshAgent and sabotage recovery.SpiralsNewly observed or returning leak-site brand with 4 September victim postings.StormRansomware brand with 36 September 2026 victim postings; the article distinguishes it from Storm-1175.Storm-1175Microsoft-tracked activity reported to exploit N-able N-central authentication-bypass flaws; the article distinguishes it from the Storm ransomware brand.Storm-2570Tracked cluster reported to use consistent remote-access, discovery, credential-theft, Defender-tampering, and cloud-exfiltration tooling across deployments involving multiple ransomware brands.Storm-3168Tracked cluster reported to abuse Azure tenants through compromised service principals and automated destructive operations; the article identifies JADEPUFFER as its alternate name.The GentlemenRansomware brand that led September 2026 tracker activity with 105 victim postings.Vexy RansomwareNewly observed or returning leak-site brand with 19 September victim postings.xpl0itrsAugust-active ransomware brand with 7 postings and no September victims in the tracker.
Malware
Vendors
Amazon Web ServicesOrganizations should treat unexpected s5cmd or Rclone installs, new AWS credential files beside temporary binaries, and large outbound object-store transfers as ransomware-stage events even when no encryptor is yetAMDRET gadgets, while Ontinue’s malware research on Lunex loaders compiled mid-September documented abuse of AMD PDFWKRNL.sys (CVE-2023-20598) to zero kernel notify callbacks after resolving offsets via Microsoft PDBCloudflareSeptember 2026 Storm-2570 reporting detailed Cloudflare Tunnel services installed under LocalSystem alongside MeshAgent, plus ngrok exposure of RDP after policy and firewall changes enabled TCP 3389.Fortinetthe United States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect,MicrosoftMicrosoft Threat Intelligence reporting published in late September 2026 showed Storm-2570 maintaining largely uniform remote-access, discovery, credential-theft, Defender tampering, and cloud-exfiltration toolingN-ableIndia, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop,
Products
AteraFortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, orAzureScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with broadly privileged service principals.Azure Resource ManagerCloud ransomware readiness must therefore include service-principal least privilege, continuous Azure Resource Manager (ARM) audit analytics, and immutable backup locks that cannot be disabled by the same compromisedFortinet SSL-VPNUnited States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect,FortiOSNSA, USSS, and the Republic of Korea’s National Police Agency (KNPA) warned that Gunra operators exploit FortiOS and FortiProxy issues, including CVE-2024-55591 and CVE-2025-24472, to obtain super-admin rights, bypassFortiProxythe Republic of Korea’s National Police Agency (KNPA) warned that Gunra operators exploit FortiOS and FortiProxy issues, including CVE-2024-55591 and CVE-2025-24472, to obtain super-admin rights, bypass MFAHypervisor-protected code integrity (HVCI)Microsoft vulnerable-driver blocking, Windows Defender Application Control (WDAC), hypervisor-protected code integrity (HVCI) where feasible, and hunts for unexpected driver service installs, PDB symbol downloadsMeshAgentinternet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driverN-able N-centralCanada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM,NinjaRMMN-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with broadlyRemotely_Agentand Settra-linked activity repeatedly documented MeshAgent, Atera, ScreenConnect, Splashtop, Remotely_Agent, and NinjaRMM as operational bridges for command execution, account manipulation, and lateralScreenConnectFortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or AzureSimpleHelpor other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with broadly privilegedSplashtopN-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants withWindows DefenderDefenders should combine Microsoft vulnerable-driver blocking, Windows Defender Application Control (WDAC), hypervisor-protected code integrity (HVCI) where feasible, and hunts for unexpected driver service installs,Windows Defender Application Control (WDAC)Defenders should combine Microsoft vulnerable-driver blocking, Windows Defender Application Control (WDAC), hypervisor-protected code integrity (HVCI) where feasible, and hunts for unexpected driver service installs,
Tools
AnyDeskOnce console trust is obtained, follow-on use of SimpleHelp, AnyDesk, BYOVD, and NTDS.dit theft shows how RMM compromise collapses multiple later ransomware steps into a single privileged beachhead.AteraFortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, orCloudflaredDetection should correlate new tunnel service creation, unexpected cloudflared binaries, and RDP enablement scripts with unauthorized RMM installs.diskpartshowed MeshAgent staging followed by ransomware child processes that invoked reagentc.exe /disable and diskpart scripts assessed to remove recovery partitions, while encrypting files with a .locked_wip extension.MeshAgentinternet-exposed Fortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driverNgrokSeptember 2026 Storm-2570 reporting detailed Cloudflare Tunnel services installed under LocalSystem alongside MeshAgent, plus ngrok exposure of RDP after policy and firewall changes enabled TCP 3389.NinjaRMMN-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with broadlyntdsutilDetection engineering that keys only on final ransomware binaries will miss the longer pre-encryption window where MeshAgent, PsExec, ntdsutil, and cloud sync utilities already establish impact conditions.PsExecDetection engineering that keys only on final ransomware binaries will miss the longer pre-encryption window where MeshAgent, PsExec, ntdsutil, and cloud sync utilities already establish impact conditions.RClonefiles to copy filtered business file types into attacker-controlled S3 buckets, while also using Rclone for continuous synchronization.reagentc.exeSeptember Settra variant showed MeshAgent staging followed by ransomware child processes that invoked reagentc.exe /disable and diskpart scripts assessed to remove recovery partitions, while encrypting files with aRemotely_Agentand Settra-linked activity repeatedly documented MeshAgent, Atera, ScreenConnect, Splashtop, Remotely_Agent, and NinjaRMM as operational bridges for command execution, account manipulation, and laterals5cmdAcross September 2026 Storm-2570 investigations, operators staged s5cmd with credential files to copy filtered business file types into attacker-controlled S3 buckets, while also using Rclone for continuousScreenConnectFortinet SSL-VPN, N-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or AzureSimpleHelpor other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with broadly privilegedSplashtopN-able N-central or other RMM consoles, commercial RMM agents (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, SimpleHelp), Windows endpoints without vulnerable-driver blocking, or Azure tenants with
Countries
BrazilMonth-on-month country counts versus August included the United States (478 → 324), Canada (42 → 37), India (29 → 28), Germany (54 → 27), France (30 → 25), Spain (20 → 24), and Brazil (23 → 23).Canadaconstruction, consumer goods, manufacturing and IT services, particularly in the United States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-centralFranceMonth-on-month country counts versus August included the United States (478 → 324), Canada (42 → 37), India (29 → 28), Germany (54 → 27), France (30 → 25), Spain (20 → 24), and Brazil (23 → 23).GermanyMonth-on-month country counts versus August included the United States (478 → 324), Canada (42 → 37), India (29 → 28), Germany (54 → 27), France (30 → 25), Spain (20 → 24), and Brazil (23 → 23).Indiaand construction, consumer goods, manufacturing and IT services, particularly in the United States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-ableSpainMonth-on-month country counts versus August included the United States (478 → 324), Canada (42 → 37), India (29 → 28), Germany (54 → 27), France (30 → 25), Spain (20 → 24), and Brazil (23 → 23).United Kingdomgoods, manufacturing and IT services, particularly in the United States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN, N-able N-central or other RMMUnited Statesreal estate and construction, consumer goods, manufacturing and IT services, particularly in the United States, India, Canada and the United Kingdom, and any organization running internet-exposed Fortinet SSL-VPN,
Industries
Consumer Goods & ServicesOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.EducationTechnology (112 → 72), Finance (62 → 47), Government & Civic (56 → 46), Materials (33 → 42) and Education (29 → 34).finance& Construction (128 → 84), Consumer Goods & Services (91 → 76), Information Technology (112 → 72), Finance (62 → 47), Government & Civic (56 → 46), Materials (33 → 42) and Education (29 → 34).Government & civic→ 84), Consumer Goods & Services (91 → 76), Information Technology (112 → 72), Finance (62 → 47), Government & Civic (56 → 46), Materials (33 → 42) and Education (29 → 34).HealthcareOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.Information TechnologyOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.ManufacturingOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.MaterialsServices (91 → 76), Information Technology (112 → 72), Finance (62 → 47), Government & Civic (56 → 46), Materials (33 → 42) and Education (29 → 34).Professional Goods & ServicesOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.real estate & constructionOrganizations within Professional Goods & Services, Healthcare, Manufacturing, Real Estate & Construction, Consumer Goods & Services and Information Technology experienced the highest levels of targeting.