Cyber Protection Operation Center

Cyberthreats and cybersecurity insights

Latest news

8Base ransomware activity surges in U.S. and Brazil

Trojanized Super Mario Bros installer spreads malware

Siemens Energy confirms data breach after MOVEit attack

Data of more than 45,000 NYC students stole in MOVEit Breach

Spotlight

Acronis

AV-TEST: Another top score for Acronis Cyber Protect in macOS evaluation

Featured stories

May 05, 2023 — 3 min read

Acronis

May 05, 2023 — 3 min read

AVLab: Acronis Cyber Protect Home Office scores best remediation time, 100% detection rate in independent evaluation

AVLab, an AMTSO member and independent testing laboratory based in Poland, evaluated Acronis Cyber Protect Home Office in their March 2023 test series. We’re pleased to announce that our solution landed in the top three tested products with regards to the "pre-launch score" — measuring malware detection rates before execution — and took the top spot in remediation speed with a time of only four seconds.

March 29, 2023 — 9 min read

Acronis

March 29, 2023 — 9 min read

SwiftSlicer: A simple yet dangerous data wiper

On January 25, 2023, ESET Research found a new data wiper in the network of Ukrinform, Ukraine’s national news agency. Later, the Computer Emergency Response Team of Ukraine (CERT-UA) added that as of January 27, five additional, different malware samples were spotted in the network.

March 06, 2023 — 15 min read

Acronis

March 06, 2023 — 15 min read

IcedID (BokBot): From banking trojan to backdoor

IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is mostly used as an initial access broker for other malware. This malware typically uses malicious email attachments to infect victims' machines. It has been known to use various types of attachments — such as archives, Word and Excel files — but the latest attacks used OneNote files.

February 02, 2023 — 8 min read

Acronis

February 02, 2023 — 8 min read

Vawtrak: A banking trojan with a long history

Vawtrak is a banking trojan — a form of malware that attempts to steal credentials from banks. It spreads via phishing emails and spam emails that contain a malicious document, loaded with a macro. The primary target of this malware are banks and insurance companies, mainly in Germany.

Meet our cyber protection experts

Acronis

Nick Grebennikov

Chief Development Officer

Acronis

Alexander Ivanyuk

Senior Director, Technology

Acronis

VP of Cyber Protection Research

Acronis

Cyber Protection Evangelist

Insights, trends, and analysis

August 25, 2022 — 9 min read

Acronis

August 25, 2022 — 9 min read

SideWinder uses weaponized Word documents to compromise victims’ machines

The SideWinder APT group was first discovered in 2018, and since earlier this year has been actively targeting military, defense and other industries in South Asia. They used to spread phishing emails with Word files that downloaded additional files to decode, drop and start the malware, which collects and uploads victims’ data to remote servers. They've since infected Android devices with malicious apps in Google Play.

August 16, 2022 — 11 min read

Acronis

August 16, 2022 — 11 min read

Hydrox: A new wiper attacks

Hydrox was first spotted by Twitter user Petrovich on July 29, 2022. On August 3, EnigmaSoft described this threat as a harmful malware that actually wipes users' data. This conclusion was made from a “ransom note” which didn’t actually contain any credentials or links for paying the ransom.

July 26, 2022 — 8 min read

Acronis

July 26, 2022 — 8 min read

Symbiote: A new stealthy malware for Linux

Symbiote is a new Linux malware that steals users’ data and provides a backdoor to threat actors. It was discovered in June, 2022 and is characterized as a very stealthy malware. It uses a lot of evasion techniques, such as hooking functions, capturing TCP traffic and hiding its own files. It collects users' data and exfiltrates it on DNS servers.

July 22, 2022 — 12 min read

Acronis

July 22, 2022 — 12 min read

CloudMensis: a new macOS threat

In April 2022, ESET researchers found a yet-unknown backdoor on macOS. It was named CloudMensis due to the fact that it uses different public cloud storage for C2 communication. CloudMensis looks for different types of documents, captures keyboard input, searches local emails and can take screen captures.

June 30, 2022 — 8 min read

Acronis

June 30, 2022 — 8 min read

Details about ZingoStealer: The new, free malware-as-a-service variant

On March 18, 2022, the Telegram public group published a post detailing the release of a new version of malware, a Windows data stealer called ZingoStealer. The group created a chat bot to field information requests, deliver more information, and even enable downloads of ZingoStealer. Later, the developer announced that cryptomining functionality was added to the stealer in order to maximize profits from its operations.

June 28, 2022 — 7 min read

Acronis

June 28, 2022 — 7 min read

Important details About BlackCat: The new version of the ALPHV ransomware-as-a-service

On March 16, 2022, security specialists identified a new version of BlackCat ransomware (so named because the software displays a black cat on the victim’s payment site). These experts also noted that some previous YARA rules no longer match, which will make it difficult to find malicious files.

April 22, 2022 — 14 min read

Acronis

April 22, 2022 — 14 min read

HermeticWiper and HermeticRansom delivered via Active Directory GPO

On February 23, 2022, a new data wiper and ransomware were deployed on a large number of devices in the Ukraine, as ESET Research reported on Twitter. Just before this, a couple of Ukrainian government sites and services were subjected to DDoS attacks. Cybersecurity specialists discovered that the malware was deployed via Microsoft Active Directory GPO. In addition to the disk wiper and ransomware, a worm component was deploy

March 16, 2022 — 9 min read

Acronis

March 16, 2022 — 9 min read

WhisperGate malware targets Ukrainian government sites

Multiple government sites in Ukraine were shut down on January 13, 2022, the result of a large-scale cyberattack by the WhisperGate malware. Microsoft Intelligence named this activity "DEV-0586" and identified it as destructive malware that used to be ransomware. Its main purpose is to disrupt the system and damage files beyond the possibility of their recovery.

December 13, 2021 — 4 min read

Acronis

December 13, 2021 — 4 min read

Critical Apache Log4j vulnerability discovered — here's what you need to know

Late last week, a critical zero-day vulnerability in the popular Java logging library Log4j surfaced when attackers were observed exploiting Minecraft servers via the game’s chat box. It has since become clear that the vulnerability in question poses perhaps the largest security threat we’ve seen in years.Details are still unfolding, but here’s what we know now.

November 30, 2021 — 9 min read

Acronis

November 30, 2021 — 9 min read

VenomRAT: A remote access tool with dangerous consequences

The first messages about VenomRAT started to appear in June 2020. By analyzing the code, analysts concluded that this new threat is a modified fork of Quasar RAT. The malware itself was introduced on malware-oriented forums, in posts advertising it as an effective tool to remotely access computers for $150 per month.

November 26, 2021 — 14 min read

Acronis

November 26, 2021 — 14 min read

Trojan-as-a-service: From Formbook to XLoader

Discovered in 2016, Formbook appeared on underground forums, advertised as an infostealer for Windows. In October 2020, Formbook was renamed XLoader; as its developers say, it has the same features, but has improved from the previous version. XLoader can steal users’ information from various browsers, email clients and messengers, and is available to cybercriminals as a service.

November 19, 2021 — 6 min read

Acronis

November 19, 2021 — 6 min read

Malware analysis: SkinnyBoy hits military, government organizations

In June 2021, military and government institutions were attacked using malware called SkinnyBoy. The malicious implant is attributed to the APT28 group, also known as Pawn Storm, Fancy Bear or Strontium. This group has been known since the mid-‘00s for cyber espionage operations, including attacks on NATO allies and organizations in the energy and transportation sectors as well as the 2016 U.S. presidential election.

#CyberFit webinars and training

Cyberstock: Ransomware, EDR and the MSP opportunity

Watch one of the year's most exciting virtual conferences for MSPs presented by Intel and Acronis.

On-demand Webinar

Defend your business from ransomware threats with an enhanced Incident Response Plan

Ransomware attacks are a real risk for businesses of any size, but there are ways to stay a step ahead.

On-demand Webinar

Chat GPT: Defending your business against AI-Supercharged ransomware

Learn how criminals may now take advantage of ChatGPT and other AI tools to improve the reach and effectiveness of their ransomware attacks.

On-demand Webinar

Cyberthreats LIVE: What MSPs need to know about the latest ransomware and cyberattacks

Our experts answer MSP’s questions while exploring the latest cyber threats, risks, and attacks threatening your clients and their data.

On-demand Webinar

Deeper dives for downloading

Explore more resources

Acronis Mid-Year Cyberthreats Report 2023

Download PDF (5.9 MB)

Acronis named Leader in Endpoint Protection in Info-Tech 2023 Market Insights

Download PDF (1,6 MB)

Checklist: Five signs you need to add EDR to your MSP tech stack

Download PDF (0.4 MB)

Acronis named top Cloud Data Security vendor by G2

Download PDF (0.3 MB)