--- title: Major cyberthreats to anticipate in the Year of the Horse description: As we celebrate Lunar New Year, it’s also a moment to reflect on our own origins. Acronis was founded in Singapore, where Lunar New Year is a festive season and cultural celebration of a new lunisolar calendar year. Honoring the Year of the Horse, this blog explores the cybersecurity challenges MSPs must be prepared for in 2026. canonical_url: https://www.acronis.com/en/blog/posts/major-cyberthreats-to-anticipate-in-the-year-of-the-horse/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Major cyberthreats to anticipate in the Year of the Horse As we celebrate Lunar New Year, it’s also a moment to reflect on our own origins. Acronis was founded in Singapore, where Lunar New Year is a festive season and cultural celebration of a new lunisolar calendar year. Honoring the Year of the Horse, this blog explores the cybersecurity challenges MSPs must be prepared for in 2026. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Allison Ho](https://staticfiles.acronis.com/images/content/4001b7fac80a9a9ed6a3a01dec591360.png)](https://www.acronis.com/en/blog/authors/allison-ho/ "Allison Ho") [Allison Ho,](https://www.acronis.com/en/blog/authors/allison-ho/)Content Marketing Manager 3 min read Last updated 23 February 2026 This Lunar New Year marks the Year of the Horse, a symbol of speed,endurance and clear direction. These traits carry relevance in today’s cybersecurity landscape. For MSPs, these characteristics aren’t just symbolic, but they’re essential to navigating rapidly changing cyberthreats. As we celebrate Lunar New Year,it’s also a moment to reflect on our own origins.Acronis was founded in Singapore, where Lunar New Year is a festive season and cultural celebration of a new lunisolar calendar year.Honoring the Year of the Horse, this blog explore s the cybersecurity challenges MSPs must be prepared for in 2026. The latest[Acronis Cyberthreats Report H2 2025](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/)shows how quickly the threat landscape is evolving and how aggressively adversaries are targeting MSP ecosystems. Based on telemetry from more than one million protected endpoints, the report highlights an environment where attackers are moving faster, exploiting trust more effectively, and targeting MSP access with unprecedented precision. [![Image 3: Acronis Cyberthreats Report H2 2025](https://staticfiles.acronis.com/images/content/a0dde6751f47f0125439246e27ea8097.png) Report Acronis Cyberthreats Report H2 2025 Explore the report](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) ## 1. Phishing: The fastest‑moving threat vector If there’s one threat that’s consistently outpacing defenses,it’s phishing.It’s no longer the nuisance it used to be. Today’s phishing techniques are AI‑sharpened, context‑awar e and often delivered where users feel safest:Within their day‑to‑day conversations across collaboration spaces. The Acronis Cyberthreats Report shows that in H 2 2025, phishing drove 52%as the top vector,targeting MSPs in numerous attacks, making it the clear leader among breach pathways.Advanced attacks accounted for**31% of collaboration platform threats**, more than**thirty times**the proportion observed in email. Malware accounted for 54%, while phishing represented only 15%.The surge is a sign that criminal s are following MSP and business workstreams and targeting shared messaging channels such as Microsoft Teams,WhatsApp and S ignal. This shift reflects two trends: * AI‑generated phishing content has increased the volume and believability of attacks. * Threat actors have expanded beyond email. In several documented incidents, impersonation te ch niques harvested MSP admin credentials, unlocking RMM consoles,and cascading access into multiple client tenants. ## 2. Ransomware: A persistent, escalating adversary Ransomware isn’t just rampant, but it’s maturing. The data shows a nearly 50%year‑over‑year increase driven by ransomware gangs Qilin,Sinobi and Akira when comparing the same period in 2023 to 2024 in the first half of 2025.Acronis detected nearly 100 active RaaS providers, with 34 new groups observed in H2 2025 alone.That’s the visible tip of the iceberg; beneath it,ransomware group s are quieter, more strategic and increasingly focused on data theft and extortion rather than typical noisy encrypt ion tactics. Key ransomware groups continue to leverage: * Mass exploitation of vulnerabilities. * Credential theft. * Phishing‑assisted intrusions. * Abuse of remote monitoring and management platforms. Notably, many actors are transitioning to stealth‑first playbooks:initial infostealers, quiet lateral movement, selective encryption and extortion anchored in exfiltrated data. This evolution puts a premium on early detection, identity controls and recovery you can trust. ## 3. RMM tools: High‑trust solutions increasingly under siege Your RMM is the nerve center of service delivery,which makes it invaluable to adversaries. In 2025, the report identified 3,000 critical vulnerabilities with some present in RMM solutions used or targeted as attack vectors, and we saw concrete evidence of vulnerability‑driven compromises and affiliate abuse. Popular RMM tools, including N-able,AnyDesk and TeamViewer RMMs were targets of cybercrime in the last half of 2025.When attackers capture the keys to your RMM, they can pivot across tenants at machine speed. Notably, the Acronis Cyberthreats Report highlighted that: * N-able N-central exhibited eexploited vulnerabilities the summer of 2025. * RMM tools such as ScreenConnect,AnyDesk, TeamViewer and Splashtop were targets of Drag onForce attacks(via ScatteredSpider enablement). * Because RMM platforms inherently hold high privilege and broad visibility, compromise translates into m ultitenant impact and increased business risk. ## Entering the year of the horse with agility and confidence MSPs should prioritize automation across their security and IT operations. Automating tasks like patch management, RMM hardening, backup validation and phishing detection frees technicians to focus on what matters most: hunting,blocking and eradicating advanced attacks and the very tactics highlighted in the Acronis Cyberthreats report’s findings. To stay ahead in 2026, MSPs should streamline routine workflows, enforce zero‑trust principles, and strengthen controls around high‑risk vectors such as phishing, collaboration apps and vulnerable RMM tools — all of which saw significant rises in exploitation. For a deeper understanding of the trends shaping the threat landscape, including AI‑driven phishing and the surge of attacks in collaboration a pp and RMM environments,explore the[Acronis Cyberthreats Report H 2 2025](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/)to stay up to date. [![Image 4: Acronis Cyberthreats Report H2 2025](https://staticfiles.acronis.com/images/content/a0dde6751f47f0125439246e27ea8097.png) Report Acronis Cyberthreats Report H2 2025 Explore the report](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) [Cyberthreats](https://www.acronis.com/en/blog/tags/cyberthreats/) [MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/) [Phishing](https://www.acronis.com/en/blog/tags/phishing/) ## Written by ![Image 5: Allison Ho](https://staticfiles.acronis.com/images/content/4001b7fac80a9a9ed6a3a01dec591360.png) Allison Ho Content Marketing Manager Allison develops content on cybersecurity, data protection, artificial intelligence and endpoint management while closely collaborating with thought leaders. Her technology B2B marketing experience includes expertise in SEO. [Previous post](https://www.acronis.com/en/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Acronis Cyberthreats Report H2 2025: Cybercriminals are now scaling attacks with AI](https://www.acronis.com/en/blog/posts/acronis-cyberthreats-report-h2-2025-cybercriminals-are-now-scaling-attacks-with-ai/) [Next post](https://www.acronis.com/en/blog/posts/msp-trends-2026-creating-opportunities-in-a-difficult-market/) [MSP trends 2026: Creating opportunities in a difficult market](https://www.acronis.com/en/blog/posts/msp-trends-2026-creating-opportunities-in-a-difficult-market/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 6: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 7: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 8: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read