--- title: Stay ahead with intelligence-driven cyberthreat research and reporting description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/ locale: en last_updated: 2026-10-27 --- 21 October 2026 The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. [Read more](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) 26 August 2026 Cambodia-focused cluster uses multistage infection chain with localized lures Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. [Read more](https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/) 19 August 2026 Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign Grandoreiro is a notorious banking trojan that has been operating across Latin America since at least 2016, targeting financial institutions and their customers through phishing campaigns and social engineering techniques. Written in Delphi and Brazilian in origin, it is one of the many of Latin American banking trojans (alongside Guildma, Javali and Melcoz). [Read more](https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/) # Stay ahead with intelligence-driven cyberthreat research and reporting 21 October 2026 [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Security Research](https://www.acronis.com/en/tru/categories/security-research/) The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 15 October 2026 [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [SMB Insights](https://www.acronis.com/en/tru/categories/smb-insights/) See how users are turning to the AI assistant in Acronis Cyber Platform to get answers and complete tasks using plain-language prompts. Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 06 October 2026 [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/) [SMB Insights](https://www.acronis.com/en/tru/categories/smb-insights/) An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. Author:[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 13 September 2026 [Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit](https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/) Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. The activity progressed from source-code theft to persistent access, credential collection, and lateral movement. Author:[Subhajeet Singha](https://www.acronis.com/en/tru/authors/singha-subhajeet/) 03 September 2026 [Remote access hardening playbook: Reducing RMM tool risk for SMBs](https://www.acronis.com/en/tru/posts/remote-access-hardening-playbook-reducing-rmm-tool-risk-for-smbs/) [SMB Insights](https://www.acronis.com/en/tru/categories/smb-insights/) Widely trusted tools like ConnectWise ScreenConnect and AnyDesk may be abused by attackers, and when left unattended, they can present a problem: Their legitimate prevalence makes attacker activity harder to spot, and any vulnerabilities affecting them can turn a trusted platform into an infection vector. Author:[Darrel Virtusio](https://www.acronis.com/en/tru/authors/virtusio-darrel/) 26 August 2026 [Cambodia-focused cluster uses multistage infection chain with localized lures](https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/) [Security Research](https://www.acronis.com/en/tru/categories/security-research/) Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. Author:[Darrel Virtusio](https://www.acronis.com/en/tru/authors/virtusio-darrel/) [View all articles](https://www.acronis.com/en/tru/posts/) ## Cybercriminals are targeting more victims by using AI to scale attacks that they know already work. Acronis Cyberthreats Report H2 2025 [Download Threat Report](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/) ## Global Cyberattack Landscape Discover how ransomware, phishing, and emerging AI-driven attacks evolve — and how Acronis helps protect your business. [Explore threat catalog](https://www.acronis.com/en/tru/threat-catalog/) ## Meet our speakers at upcoming events ### AVAR 2026 In person Cybersecurity [AVAR 2026 agenda](https://events.aavar.org/cybersecurity-conference/index.php/agenda/) 2nd to 4th December 2026 | Hyderabad, India From Open Directories to AI-Coded Malware: How a Pakistan-Nexus Threat Actor Leaked Their Entire Arsenal Targeting Afghan Telecom and South Asian Critical Infrastructure ![Image 2: Subhajeet Singha](https://staticfiles.acronis.com/images/content/b26e3c5aec6ef098ac310b2341106a26.png) Subhajeet Singha Subhajeet works around threat intelligence, malware research, and reverse engineering. Subhajeet actively investigates advanced persistent threats (APTs), reverse-engineers complex malware strains, and contributes to research initiatives that improve threat detection.