Back to homepage
Search in acronis websites
Try Now

Acronis Blog

TRU Security →
Updates from Acronis Threat Research Unit
Acronis Blog
Ransomware protection

All stories in Ransomware protection

November 07, 2026 — 3 min read
Acronis research reveals how Qilin ransomware targets virtual infrastructure
November 07, 2026 — 3 min read
Acronis research reveals how Qilin ransomware targets virtual infrastructure
A new analysis from the Acronis Threat Research Unit (TRU), published October 28, 2026, examines how the operation combines adaptable ransomware, attacks on VMware ESXi environments and double extortion to pressure organizations.
June 04, 2021 — 5 min read
Threat analysis: DoppelPaymer ransomware
June 04, 2021 — 5 min read
Threat analysis: DoppelPaymer ransomware
DoppelPaymer is a successor of BitPaymer ransomware, and is part of the Dridex malware family. It’s currently being distributed in various forms, including phishing or spam emails with attached documents that are embedded with malicious code — either JavaScript or VBScript. On execution, this code downloads DoppelPaymer’s first-stage loader on the victim’s machine. The attackers then use the PowerShell Empire toolkit to run a brute-force attack on Active Directory. The Mimikatz module is used to dump passwords from the system memory.
June 04, 2021 — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
June 04, 2021 — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
Pysa takes an approach commonly referred to as “big game hunting,” meaning that the ransomware group targets high-value assets in organizations that are particularly sensitive to data loss or system downtime. The idea is that victims — which may include healthcare providers, government agencies, and managed service providers — are more likely to quickly pay the ransom, regardless of its cost.
June 04, 2021 — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
June 04, 2021 — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager before encryption.
June 04, 2021 — 8 min read
Sekhmet ransomware Analysis
June 04, 2021 — 8 min read
Sekhmet ransomware Analysis
Sekhmet ransomware, which first appeared in March 2020, has already disclosed the stolen data from at least six victims to date. One recent known attack that occurred on 20 June 2020 targeted SilPac, a gas handling solutions company based in Santa Clara, California.
June 04, 2021 — 7 min read
Analysis of Ragnar Locker Ransomware
June 04, 2021 — 7 min read
Analysis of Ragnar Locker Ransomware
The threat actor begin the attack by compromising the company’s network via RDP service, using brute force to guess weak passwords or with stolen credentials bought on the Dark Web. Next, the attacker performs second-stage reconnaissance. To elevate privileges, the attacker exploits the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code with elevated privileges.
June 03, 2021 — 2 min read
TAG Cyber names Acronis Distinguished Vendor in Q2 2021 Security Annual
June 03, 2021 — 2 min read
TAG Cyber names Acronis Distinguished Vendor in Q2 2021 Security Annual
Acronis has been named a TAG Cyber Distinguished Vendor in 2021, and part of the benefits of this designation include being featured in the firm’s flagship “Security Annual” quarterly reports. To this end, TAG Cyber’s Q2’21 report was recently published. The report is, for a lack of a better word, a “beast.” It is over 100 pages long and includes 10 op-eds, 13 interviews with industry executives, and five technical whitepapers. While we certainly recommend the entire thing, we also know your time may be limited. That’s why we made a summary of the report that streamlined the content that was most relevant to the Acronis community. Let's take a quick look at what's included.
May 06, 2021 — 1 min read
Top 5 Vulnerabilities of SMBs
May 06, 2021 — 1 min read
Top 5 Vulnerabilities of SMBs
Cyberattacks can cause several different types of losses to your business. Loss of access to vital customer information or critical financial data can be detrimental. Brand reputation can be impacted if customers lose faith. Knowing where your business is vulnerable to a cybercriminal’s endeavors is the first step to cyber protection and mitigating risk.
April 13, 2021 — 2 min read
Canalys adds Acronis to Endpoint Security Performance Index
April 13, 2021 — 2 min read
Canalys adds Acronis to Endpoint Security Performance Index
With the launch of Acronis Cyber Protect in 2020, we began to compete in other sectors above and beyond backup and recovery. With integrated anti-malware, vulnerability assessments, and URL filtering, Acronis started looking more like an endpoint protection solution – and it seems the analyst community took notice. Most notably, the market research firm Canalys recently began including Acronis in their Endpoint Security Vendor Performance Index, and our unified solutions performed very well.
April 01, 2021 — 2 min read
Cyber Protection Week 2021: If it ain't broke, it still might need fixing
April 01, 2021 — 2 min read
Cyber Protection Week 2021: If it ain't broke, it still might need fixing
Traditional backup and cybersecurity solutions can’t fully protect modern data and devices. Data loss is on the rise for individual IT users and IT professionals because outdated solutions are being applied to today’s cyberthreats. It’s time to rethink how you approach cyber protection. Check out how to get started with this infographic.
March 30, 2021 — 7 min read
Top 9 tech takeaways from the Cyber Protection Week Global Report 2021
March 30, 2021 — 7 min read
Top 9 tech takeaways from the Cyber Protection Week Global Report 2021
Everyone in the world relies on data – from students attending classes on Zoom to MSPs managing the IT needs of dozens of different companies. But their experiences, concerns, and priorities when it comes to technology are uniquely their own.
March 29, 2021 — 5 min read
Cyber Protection Week 2021: Time to rethink your defenses
March 29, 2021 — 5 min read
Cyber Protection Week 2021: Time to rethink your defenses
This Cyber Protection Week – March 29 through April 2 – individuals and organizations around the globe have experienced changes they couldn’t have planned for. Along the way, many found that the solutions they had in place weren’t enough to keep the data they rely on protected. It’s time to rethink how we protect data, applications, and systems. And to do that, we surveyed 4,400 personal IT users and IT professionals from around the world, collected their unique experiences and concerns to create the inaugural Cyber Protection Week Global Report.
March 11, 2021 — 4 min read
SMBs face cybersecurity challenges post-pandemic
March 11, 2021 — 4 min read
SMBs face cybersecurity challenges post-pandemic
After a year of struggling to adapt to the pandemic-driven shift to remote work, rapid SaaS application adoption, and an FBI-documented 300% increase in cybersecurity attacks, small and mid-sized business (SMB) tech leaders and advisors are looking ahead with relief to a return to relative normalcy. But certain challenges are expected to remain, especially in light of their paltry budgets. In fact, Untangle’s 2020 SMB IT Security Report notes that 39% of SMBs are still investing less than $1,000 per year on IT security. Our recent panel-driven virtual conference, A New Playbook to Protect Your Users from Cyberthreats in 2021, examined how small-business IT managers anticipate that many changes wrought by the pandemic will have lasting effects on their cybersecurity strategies.