MSP cybersecurity news digest, October 13, 2025

A security roundup reports multiple active and high-impact incidents: Medusa ransomware is exploiting a maximum-severity RCE in Fortra’s GoAnywhere MFT to perform deserialization and command-injection attacks for data theft and ransomware deployment; attackers used a compromised Zendesk instance to exfiltrate Discord user ticket data (including ~70,000 ID photos); Vampire Bot is distributing an infostealer via fake job ads and typosquatted sites; Asahi Group experienced production downtime after a ransomware attack attributed to Qilin; and Storm-2603 abused the legitimate Velociraptor DFIR tool to establish covert C2 and stage ransomware, with recommended mitigations including isolation, credential rotation, strict network controls, and application of vendor patches.