Acronis Blog

Acronis Blog
Cybersecurity

All stories in Cybersecurity

May 20, 2025  — 22 min read
Acronis
May 20, 2025  — 22 min read
From banks to battalions: SideWinder’s attacks on South Asia’s public sector
Acronis Threat Research Unit (TRU) uncovered a new SideWinder APT campaign targeting high-level government institutions in Sri Lanka, Bangladesh and Pakistan.
June 04, 2021  — 5 min read
Acronis
June 04, 2021  — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
Pysa takes an approach commonly referred to as “big game hunting,” meaning that the ransomware group targets high-value assets in organizations that are particularly sensitive to data loss or system downtime. The idea is that victims — which may include healthcare providers, government agencies, and managed service providers — are more likely to quickly pay the ransom, regardless of its cost.
June 04, 2021  — 8 min read
Acronis
June 04, 2021  — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager before encryption.
June 04, 2021  — 2 min read
Acronis
June 04, 2021  — 2 min read
Shlayer malware Analysis and Detection
The first examples of the Shlayer malware family were discovered in February 2018. Since then, it has become the most popular macOS first-stage trojan-downloader. Shlayer remotely installs other malicious or potentially unwanted applications such as Cimpli, Bnodlero, Geonei, and Pirrit adware for macOS X desktops and laptops, mostly targeting US-based users. Once installed, the adware collects the victim’s personal data and tracks browsing activities that can be used to target additional ads. This newest version of the trojan leverages a Python script for stealthier execution of the malicious payload and employs data encryption for communications with its external command and control (C&C) server. The Python script and crypto library are delivered inside of the trojan’s DMG installer.
June 04, 2021  — 8 min read
Acronis
June 04, 2021  — 8 min read
Sekhmet ransomware Analysis
Sekhmet ransomware, which first appeared in March 2020, has already disclosed the stolen data from at least six victims to date. One recent known attack that occurred on 20 June 2020 targeted SilPac, a gas handling solutions company based in Santa Clara, California.
June 04, 2021  — 7 min read
Acronis
June 04, 2021  — 7 min read
Analysis of Ragnar Locker Ransomware
The threat actor begin the attack by compromising the company’s network via RDP service, using brute force to guess weak passwords or with stolen credentials bought on the Dark Web. Next, the attacker performs second-stage reconnaissance. To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges.
June 03, 2021  — 2 min read
Acronis
June 03, 2021  — 2 min read
TAG Cyber names Acronis Distinguished Vendor in Q2 2021 Security Annual
Acronis has been named a TAG Cyber Distinguished Vendor in 2021, and part of the benefits of this designation include being featured in the firm’s flagship “Security Annual” quarterly reports. To this end, TAG Cyber’s Q2’21 report was recently published. The report is, for a lack of a better word, a “beast.” It is over 100 pages long and includes 10 op-eds, 13 interviews with industry executives, and five technical whitepapers. While we certainly recommend the entire thing, we also know your time may be limited. That’s why we made a summary of the report that streamlined the content that was most relevant to the Acronis community. Let's take a quick look at what's included.
June 01, 2021  — 4 min read
Acronis
June 01, 2021  — 4 min read
What is an email cyberattack?
It is another workday, and one of your client’s users is perusing through their inbox and sees an email from the U.S. Internal Revenue Service (IRS). Her first thought is, “Why would the IRS be contacting me?” Without thinking further, she quickly opens the email, clicks on the link and BAM! Next thing she sees on her screen is a message telling her that her files have been encrypted and she must pay a ransom to get the key to decrypt them.
May 29, 2021  — 2 min read
Acronis
May 29, 2021  — 2 min read
SolarWinds hackers launch new attacks, warns Microsoft
The Microsoft Threat Intelligence Center (MSTIC) has uncovered a wide-scale spear phishing campaign driven by Nobelium — the threat actors behind the recent SolarWinds attacks and the SUNBURST backdoor used in those strikes. Nobelium continues its attacks on U.S. agencies and the private organizations in their sphere. The group managed to hijack an email distribution account used by the United States Agency for International Development (USAID), sending thousands of authentic-looking but malware-laden messages to a variety of human rights groups, think tanks, and other organizations.
May 20, 2021  — 6 min read
Acronis
May 20, 2021  — 6 min read
3 Ways to avoid malware infection in software patches
The objective of a software patch is to eliminate a vulnerability or fix a software flaw that is identified after the software is released, add new functionality or improve performance. Timely installation of newly released patches is an important maintenance step. It keeps your systems current and stable, optimizes performance, and mitigates the threat of new malware infection.
May 14, 2021  — 5 min read
Acronis
May 14, 2021  — 5 min read
Cyberthreat update from Acronis CPOCs: Week of May 10, 2021
Here at Acronis, we’re always monitoring for dangers to your data, deploying updates to handle newly-discovered vulnerabilities, and issuing alerts and recommendations to help you stay protected. Our global network of Acronis Cyber Protection Operations Centers (CPOCs) continue to work around the clock to proactively detect and defend against the latest cyberthreats.
May 10, 2021  — 3 min read
Acronis
May 10, 2021  — 3 min read
DarkSide ransomware attack on Colonial Pipeline cripples energy infrastructure
In the latest incident that illustrates the overlap of the traditional economy and infrastructure with the digital realities of modern business, one of the largest pipelines in the U.S. was forced to shut down this past weekend after being hit by a ransomware group. Managed by Colonial Pipeline Co., the 5,500-mile pipeline runs across 14 states between Houston, TX and New York Harbor, and provides around 45% of all fuel for the U.S. East Coast.
May 08, 2021  — 4 min read
Acronis
May 08, 2021  — 4 min read
Cyberthreat update from Acronis CPOCs: Week of May 3, 2021
Here at Acronis, we’re always monitoring for dangers to your data, deploying updates to handle newly-discovered vulnerabilities, and issuing alerts and recommendations to help you stay protected. Our global network of Acronis Cyber Protection Operations Centers (CPOCs) continue to work around the clock to proactively detect and defend against the latest cyberthreats. Part of this work includes video updates to inform you of modern hazards in the digital landscape — such as large-scale strikes against major organizations and the emergence of new malware threats. Here’s a look at some of the most recent breaking news and analyses: