Ransomware Q3 2025: a threat that is settling in and reinventing itself
Cyna CERT ransomware report Q3 2025: nearly 600 victims in September, a threat that settles in and reinvents itself. Analysis and lessons for MSPs.
A historically high number of victims
Forget the usual seasonal lulls.
With nearly 600 victims worldwide in September alone, criminal activity remains higher than in the past two years.
Attackers are no longer content to strike hard; they strike continuously, with a resilience that challenges our defence models.
Focus on France: new players arrive
While the Qilin group continues to dominate the global landscape, France is seeing new actors emerge with formidable methods.
Who is the Nova group, this opportunistic actor shaking up the local hierarchy?
The report unpacks their rise and the growing diversity of threats, between financial and ideological motivations.
Targeted sectors: nobody is safe
Worldwide, Technology takes back the top spot in the ranking, but in France it is dispersion that dominates.
Construction, Healthcare, Services… attackers are now testing the maturity of every link in the economy. No sector can consider itself “off the radar” any more.
How to regain the upper hand?
Because a finding without action is useless, our CERT has built practical and technical guides into this report.
You will find the keys to:
- Securing your email: why is the SPF, DKIM and DMARC trio your best barrier against spoofing?
- Reducing your attack surface: how can you use conditional access to close the door on suspicious foreign sign-ins?
Don’t let your organisation navigate blind in this shifting landscape. Anticipate tomorrow’s threats by understanding yesterday’s mechanics.
Download the CERT report for the third quarter of 2025
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.