Acronis Blog

Acronis Blog
Threat detection

All stories in Threat detection

06 May 2025  — 3 min read
Acronis
06 May 2025  — 3 min read
Why native RMM and security integration is essential for MSP 3.0 evolution
Native integration between RMM and security empowers MSPs to deliver stronger protection, more efficiently, without needing to reinvent their business models.
06 March 2023  — 15 min read
Acronis
06 March 2023  — 15 min read
IcedID (BokBot): From banking trojan to backdoor
IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is mostly used as an initial access broker for other malware. This malware typically uses malicious email attachments to infect victims' machines. It has been known to use various types of attachments — such as archives, Word and Excel files — but the latest attacks used OneNote files.
13 February 2023  — 7 min read
Acronis
13 February 2023  — 7 min read
CaddyWiper makes Windows machines unusable
CaddyWiper is an example of data-wiping malware, whose purpose is to corrupt the operating system and leave the targeted device unusable. It was first spotted in Ukraine in mid-March 2022 by the ESET research team.
06 February 2023  — 8 min read
Acronis
06 February 2023  — 8 min read
DoubleZero: A data wiper deployed against Ukraine
The DoubleZero wiper — so named for its tactic of zeroing files — was first discovered on March 17, 2022 by CERT-UA (the Computer Emergency Response Team of Ukraine). The malware was designed in order to wipe out system files, non-system files and entire registry branches, and was spread by spear phishing emails with an attached ZIP that contains the malware file.
02 February 2023  — 8 min read
Acronis
02 February 2023  — 8 min read
Vawtrak: A banking trojan with a long history
Vawtrak is a banking trojan — a form of malware that attempts to steal credentials from banks. It spreads via phishing emails and spam emails that contain a malicious document, loaded with a macro. The primary target of this malware are banks and insurance companies, mainly in Germany.
05 January 2023  — 9 min read
Acronis
05 January 2023  — 9 min read
Royal ransomware’s actors make high demands
Royal ransomware was first spotted in January 2022, targeting different corporations. This group does not provide ransomware-as-a-service. The attackers demand figures ranging from $250,000 to over $2 million from their victims.
09 December 2022  — 9 min read
Acronis
09 December 2022  — 9 min read
KmsdBot: DDoS and cryptomining combined
On November 10, 2022, the Akamai Security Intelligence Response Team published an article with the description of the newly spotted KmsdBot, which infected their honeypot. Gaming company FiveM, which provides software for GTA V for hosting custom private servers (and happens to be Akamai’s client), became the first victim. During their investigation, researchers found many samples that were built for different architectures.
05 December 2022  — 3 min read
Acronis
05 December 2022  — 3 min read
AV-TEST: Acronis Cyber Protect again earns macOS certification, outperforming other solutions
AV-TEST, the renowned independent evaluator of antivirus and security solutions, recently released the results of their September 2022 evaluation of business security products for macOS Monterey. Acronis Cyber Protect showed excellent results — outperforming other participants like Bitdefender and Trellix (McAfee) — and earned a Certified badge for Corporate Endpoint Protection on macOS systems.
28 November 2022  — 9 min read
Acronis
28 November 2022  — 9 min read
AXLocker ransomware doesn’t change files’ extensions
AXLocker is a ransomware that was found by malware researcher ‘S!ri,’ who posted it on Twitter. Later, it was discovered that AXLocker does not only encrypt files but also steals victims’ Discord credentials and uploads them to its own Discord server. Specifically, the AXLocker ransomware steals tokens stored on a local computer when the user logs in to Discord. It’s not packed or obfuscated.
25 November 2022  — 8 min read
Acronis
25 November 2022  — 8 min read
Killnet ransomware — a wiper from the Chaos family
Killnet is a Russian hacker group, previously known for providing DDoS services. At the end of October 2022, the security channel PCrisk discovered the first sample of Killnet ransomware. The group, via a Telegram channel, also announced a ransomware attack on an Italian chemical factory.
22 September 2022  — 9 min read
Acronis
22 September 2022  — 9 min read
RapperBot: A new threat for IoT devices
On June 22, 2022, CNCERT IoT Threat Research Team and NSFOCUS FuYingLab monitored a new botnet that was attacking IoT devices. Naming the threat ‘RapperBot,’ researchers found more than 5,000 compromised hosts, but no attack commands were spotted. In analyzing samples, cybersecurity analytics found similarities with Mirai Bot, whose source code has been leaked.
16 September 2022  — 2 min read
Acronis
16 September 2022  — 2 min read
AV-TEST: Acronis Cyber Protect earns macOS certification, all-around excellent results again
AV-TEST, the renowned independent evaluator of antivirus and security solutions, recently released the results of their June 2022 evaluation of business security products for macOS Monterey. Acronis Cyber Protect was one of the participants and showed excellent results — earning a well-deserved Approved badge for Corporate Endpoint Protection on macOS systems.
15 September 2022  — 4 min read
Acronis
15 September 2022  — 4 min read
Is there a cyberconflict happening behind the scenes?
If you’re reading this, you’re somehow connected to the cyberworld that’s rapidly transforming the way the world functions. While this adaptation means an overall benefit to progressive societies, it opens new and innovative ways for cyberattackers to target organizations and consumers alike.