Back to homepage
Search in acronis websites
Try Now

Acronis Blog

TRU Security →
Updates from Acronis Threat Research Unit
Acronis Blog
Cyberthreats

All stories in Cyberthreats

November 09, 2026 — 4 min read
Beyond data, inside the attacks: Introducing Acronis TRU Cyber Pulse 2026
November 09, 2026 — 4 min read
Beyond data, inside the attacks: Introducing Acronis TRU Cyber Pulse 2026
Acronis TRU Cyber Pulse 2026 takes readers inside threat investigations to reveal how threat actors operate, the patterns connecting their campaigns and what defenders can learn from them.
August 05, 2021 — 6 min read
Attending #BHUSA 2021: The cybersecurity experts’ view
August 05, 2021 — 6 min read
Attending #BHUSA 2021: The cybersecurity experts’ view
As Diamond sponsors for the Black Hat 2021 conference, Acronis sent Acronis’ VP of Cyber Protection Research Candid Wuest and Cybersecurity Analyst Topher Tebow to attend sessions, answer questions, and gather as many insights as possible.
July 28, 2021 — 6 min read
#BHUSA or bust: Hopes and expectations for Black Hat 2021
July 28, 2021 — 6 min read
#BHUSA or bust: Hopes and expectations for Black Hat 2021
Since 1997, Black Hat has been a staple in the world of cybersecurity conferences. Having been in cybersecurity for nearly a decade, I’ve been aware of Black Hat, but haven’t had the opportunity to attend. Sure, I’ve attended DEF CON and some local cybersecurity conferences, but never one with a corporate focus.
July 26, 2021 — 2 min read
Acronis Cyber Platform now integrates with Jamf Pro
July 26, 2021 — 2 min read
Acronis Cyber Platform now integrates with Jamf Pro
At Acronis, we strive to ensure that our service provider partners can make full use of our comprehensive cyber protection solutions alongside the tools that they already rely on. Today, we’re pleased to announce that Acronis Cyber Platform now integrates with Jamf Pro, a comprehensive enterprise management solution for the Apple ecosystem, enabling MSPs to strengthen their cyber protection services for clients’ macOS devices while simplifying internal processes. This effort marks the latest entry to Acronis’ growing list of seamless integrations with leading RMM/PSA vendors, and is the first integration between Acronis Cyber Platform and a third-party vendor that’s focused solely on macOS environments.
July 21, 2021 — 5 min read
MSPs learn cyber protection best practices from sports tech leaders at #MSInspire
July 21, 2021 — 5 min read
MSPs learn cyber protection best practices from sports tech leaders at #MSInspire
Technology leaders from two of Acronis #CyberFit Sports Partners wowed attendees at Microsoft Inspire 2021 with a live panel discussion entitled, “Lessons for MSPs from Professional Sports Teams on Protecting Microsoft Environments”.
July 15, 2021 — 4 min read
#MSInspire living up to its name for partners
July 15, 2021 — 4 min read
#MSInspire living up to its name for partners
With one day down and the second underway, there’s been a lot of excitement at the Microsoft Inspire 2021 event. As promised, it’s a great opportunity to get a preview of the upcoming advances in Microsoft’s technology and its ecosystem of 400,000 partners, as well as to connect with our partners in attendance who are looking to protect their clients’ Microsoft environments.
June 24, 2021 — 10 min read
What is anti-malware software and how does it work?
June 24, 2021 — 10 min read
What is anti-malware software and how does it work?
Cybercriminals are using the most advanced technologies to gain access to your system(s) and steal your sensitive and private data for financial gain. To keep up, cybersecurity vendors are working hard to incorporate these same technologies to stop these modern-day attacks. Whether you are a consumer or business, this article will help you better understand what malware is and what you can do to stop these continued attacks
June 04, 2021 — 5 min read
Threat analysis: DoppelPaymer ransomware
June 04, 2021 — 5 min read
Threat analysis: DoppelPaymer ransomware
DoppelPaymer is a successor of BitPaymer ransomware, and is part of the Dridex malware family. It’s currently being distributed in various forms, including phishing or spam emails with attached documents that are embedded with malicious code — either JavaScript or VBScript. On execution, this code downloads DoppelPaymer’s first-stage loader on the victim’s machine. The attackers then use the PowerShell Empire toolkit to run a brute-force attack on Active Directory. The Mimikatz module is used to dump passwords from the system memory.
June 04, 2021 — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
June 04, 2021 — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
Pysa takes an approach commonly referred to as “big game hunting,” meaning that the ransomware group targets high-value assets in organizations that are particularly sensitive to data loss or system downtime. The idea is that victims — which may include healthcare providers, government agencies, and managed service providers — are more likely to quickly pay the ransom, regardless of its cost.
June 04, 2021 — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
June 04, 2021 — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager before encryption.
June 04, 2021 — 2 min read
Shlayer malware Analysis and Detection
June 04, 2021 — 2 min read
Shlayer malware Analysis and Detection
The first examples of the Shlayer malware family were discovered in February 2018. Since then, it has become the most popular macOS first-stage trojan-downloader. Shlayer remotely installs other malicious or potentially unwanted applications such as Cimpli, Bnodlero, Geonei, and Pirrit adware for macOS X desktops and laptops, mostly targeting US-based users. Once installed, the adware collects the victim’s personal data and tracks browsing activities that can be used to target additional ads. This newest version of the trojan leverages a Python script for stealthier execution of the malicious payload and employs data encryption for communications with its external command and control (C&C) server. The Python script and crypto library are delivered inside of the trojan’s DMG installer.
June 04, 2021 — 8 min read
Sekhmet ransomware Analysis
June 04, 2021 — 8 min read
Sekhmet ransomware Analysis
Sekhmet ransomware, which first appeared in March 2020, has already disclosed the stolen data from at least six victims to date. One recent known attack that occurred on 20 June 2020 targeted SilPac, a gas handling solutions company based in Santa Clara, California.
June 04, 2021 — 7 min read
Analysis of Ragnar Locker Ransomware
June 04, 2021 — 7 min read
Analysis of Ragnar Locker Ransomware
The threat actor begin the attack by compromising the company’s network via RDP service, using brute force to guess weak passwords or with stolen credentials bought on the Dark Web. Next, the attacker performs second-stage reconnaissance. To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges.