Beyond data, inside the attacks: Introducing Acronis TRU Cyber Pulse 2026

Acronis TRU Cyber Pulse 2026 takes readers inside threat investigations to reveal how threat actors operate, the patterns connecting their campaigns and what defenders can learn from them. 

The report brings together security investigations from the Acronis Threat Research Unit (TRU) and examines how threat actors operate, the patterns between their campaigns and what those findings mean for service providers and organizations defending interconnected IT environments.

Throughout the year, TRU researchers reverse engineer malware, track campaigns, support incident response investigations and examine emerging security challenges. Individual investigations reveal how a particular attack works. Examined together, they expose patterns that can help defenders anticipate what comes next.

The new report organizes those findings around three principal areas:

• Emerging attack techniques: AI-augmented operations, identity compromise and attempts to disable security controls.
• Advanced persistent threats and espionage: How operators establish access, maintain persistence and exploit trusted services and relationships.
• Cybercrime: Changes in ransomware operations, the infostealer economy, abuse of legitimate platforms and attacks on Linux and virtualization.

Each area connects attacker behavior with its operational consequences, giving readers a way to turn research into priorities for their own environments.

Report

Acronis TRU Cyber Pulse 2026

Read the report

AI features prominently in the report as its role in attacks is expanding. Threat actors are connecting models with offensive tools, credentials and persistent memory to coordinate larger portions of an operation.

TRU’s BOSSAI investigation illustrates that shift. A single technically capable operator connected more than 10 models to offensive frameworks and tools, building an environment that supported reconnaissance, exploitation and infrastructure management across targets in multiple countries.

The report also examines risks facing organizations adopting AI tools themselves:

• TRU identified more than 575 malicious OpenClaw skills across 13 developer accounts, with packages impersonating legitimate utilities.
• Infostealers are targeting AI provider API keys and credentials associated with coding tools.
• Exposed agent gateways can give attackers opportunities to reach commands, files and credentials.

For MSPs introducing AI into service delivery and for businesses adopting coding assistants or agents, these findings make permissions a central security consideration. Readers will learn why the tools an agent can invoke, the data it can retrieve and the systems enforcing its boundaries deserve close attention.

One of the report’s most consequential themes is the reach of compromised identity. Attackers seek passwords, browser cookies, active sessions, cloud credentials and remote-management accounts. That access can be sold, transferred or used to reach additional services.

A technician’s compromised workstation may therefore warrant investigation across client environments. A stolen employee session may expose cloud applications even after malware has been removed from the original device.

Remote administration adds another layer. In TRU’s analysis of more than 1.8 million endpoints already running Acronis RMM, 63.1% had at least one additional RMM or remote-access tool installed. Many support legitimate needs, but providers need to understand which tools are approved, who operates them and what access remains after service changes.

The report explains why endpoint cleanup, session revocation and reviews of subsequent account activity need to work together.

A trusted domain or signed application can make malicious activity harder to recognize. The report examines how espionage operators and cybercriminals use legitimate services to distribute malware, receive instructions and conceal their infrastructure.

Investigations cover cloud storage, spreadsheets, GitHub and messaging platforms, as well as malicious applications carrying valid code-signing certificates.

For defenders, the value lies in understanding how that trust is exploited. The report highlights the importance of examining which processes contact a service, how they use its APIs and whether that behavior belongs on the system.

It also explores how ransomware capabilities persist as groups fragment, affiliates move and source code circulates. Tracking those connections can help organizations understand the capabilities behind newly emerging groups.

The report looks closely at attackers’ efforts to disable endpoint protection, interfere with logging and disrupt recovery. These actions can reduce visibility precisely when defenders need it most.

Its ransomware coverage also extends to Linux and ESXi, where attacks can affect infrastructure supporting multiple workloads. Unexpected virtual-machine shutdowns and snapshot deletions may signal activity that threatens both production services and recovery.

For businesses, this makes the report relevant to continuity planning as well as security operations. For MSPs, it helps frame recovery discussions around shared infrastructure, administrative access and dependencies between customer services.

The report closes with recommendations that help readers apply its findings:

• Trace compromised identities into connected applications and customer environments.
• Prioritize exposed systems according to the access they provide.
• Investigate unexpected remote-tool activity and losses of security visibility.
• Test recovery when normal administrative systems cannot be trusted.
• Limit AI agents’ authority through enforceable permissions.
• Establish containment and recovery decisions before an incident.

MSPs can use these insights to review service practices and guide customer conversations. Businesses can use them to assess internal controls, ask informed questions of providers and strengthen response plans.

The Acronis TRU Cyber Pulse 2026 brings readers closer to the investigations behind the headlines. Explore the report for detailed campaign analysis, emerging attack techniques and practical guidance to help protect your service provider business and the organizations you support.

Report

Acronis TRU Cyber Pulse 2026 

Read the report