MSP cybersecurity news digest, September 23, 2025

Acronis TRU reports multiple active threats: trojanized ConnectWise ScreenConnect installers distributing AsyncRAT and a custom PowerShell RAT (with later PureHVNC deployments), a widespread FileFix campaign delivering the StealC infostealer via steganography and phishing, a large Iranian-linked spear-phishing operation compromising 100+ embassy accounts, and a ransomware attack on Collins Aerospace that disrupted European airports; additionally Microsoft’s September 2025 Patch Tuesday addresses 81 flaws including two zero-days in SMB and SQL Server components.