Acronis defends against every attack in AV-TEST's Real-World ATP evaluation

Acronis Cyber Protect Cloud once again has been recognized by AV-TEST for outstanding endpoint protection performance, achieving a perfect score in the March–April 2025 Advanced Threat Protection (ATP) test. This latest evaluation focused on stopping fileless malware attacks, using scenarios built around MSBuild (Microsoft Build Engine), a trusted Windows utility often abused by attackers.

This wasn’t a standard malware detection test. The AV-TEST ATP series simulates realistic attack chains, mimicking what security teams face in actual environments. In this round, the lab used a consistent attack technique across all scenarios — a technique widely abused in the wild but difficult to detect.

Each attack leveraged MSBuild, a legitimate Windows development tool used to compile applications from project files. While safe in regular use, attackers have learned to embed malicious code inside .proj or .csproj files and execute that code through MSBuild.

The result is a fileless attack: Nothing is dropped on disk, and the malicious payload runs directly in memory. Since MSBuild is a trusted binary, traditional security solutions might allow it to run, completely unaware that it's executing malicious logic. This method is part of a growing category of “living-off-the-land” techniques, in which attackers use legitimate system tools for malicious purposes.

AV-TEST designed 10 separate attack scenarios, five involving ransomware and five focused on information theft (infostealer malware). Every scenario used MSBuild as the delivery mechanism. The threats were launched through realistic infection methods, such as opening email attachments or executing modified script files.

Each tested product was scored based on how well it stopped the attack across its full execution chain. For ransomware samples, products could score up to three points per test:

• One point for basic detection
• Two points for partial blocking
• Three points for completely preventing encryption

For infostealers, the score extended to four points per attack, with an additional point awarded for stopping data exfiltration.

The maximum score was 35 points, and Acronis achieved the full score, proving that Acronis Cyber Protect Cloud successfully prevented both file encryption and data theft in every case.

What makes this achievement significant is not just that Acronis detected the threats, but that it fully contained them. In a fileless attack, threats don’t leave obvious traces. Blocking the execution or removing the payload from memory requires advanced behavioral analysis and real-time protection mechanisms.

Additionally, this evaluation reflects modern attacker tactics, with which threats are delivered silently using trusted tools to evade antivirus and EDR solutions. Defending against these requires more than signatures: It requires intelligent response at runtime.

For managed service providers (MSPs), IT security teams and businesses that need assurance against stealthy, evasive threats, this test provides clear evidence that Acronis Cyber Protect Cloud delivers full-spectrum protection — even against memory-resident malware and system tool abuse.

AV-TEST’s March–April 2025 ATP evaluation presented one of the most challenging test conditions to date. By using MSBuild as a delivery vector, the lab simulated precisely the kind of stealthy, modern attack that traditional tools often miss.

Acronis was among only four vendors to achieve a flawless 35 / 35 score, with no data exfiltrated and no files encrypted in any scenario. Acronis Cyber Protect Cloud received AV-TEST’s Top Product award in the Advanced Threat Protection category. The test was not part of the certification test series in the same time frame, and so a certification badge was not issued.

The test results demonstrate Acronis’ ability to stop threats that operate entirely in memory and misuse trusted system components — exactly the kind of attacks today’s enterprises and service providers are most concerned about.

Read the full report here.