--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 21 October 2026 ### [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. 15 October 2026 ### [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) See how users are turning to the AI assistant in Acronis Cyber Platform to get answers and complete tasks using plain-language prompts. 13 October 2026 ### [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. 06 October 2026 ### [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/) An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. 16 September 2026 ### [Acronis Cyberthreats Update, September 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-september-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in August 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. 01 September 2026 ### [Acronis Cyberthreats Update, August 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-august-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in July 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. 18 August 2026 ### [How patch quality varies by vendor across SMB Windows fleets](https://www.acronis.com/en/tru/posts/how-patch-quality-varies-by-vendor-across-smb-windows-fleets/) Patch prioritization in SMB environments often starts with software vendor severity. Critical patches go first, then high-severity patches, then everything else. Severity answers only one question: How risky is it to leave a vulnerability unresolved? It says nothing about how hard the fix is to deploy, how often it causes issues or how much testing it needs. 13 August 2026 ### [PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure](https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/) Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. 06 August 2026 ### [Advancing toward agent health and self-recovery for MSP operations](https://www.acronis.com/en/tru/posts/advancing-toward-agent-health-and-self-recovery-for-msp-operations/) The business value of better agent health assurance is straightforward. MSPs spend less time on repetitive checks and manual service recovery. Technicians can focus on issues that require judgment instead of routine restarts. Service managers can see which customers or services have repeated problems. Customers receive more stable protection and management coverage. 30 July 2026 ### [Two ways to scale your scripts](https://www.acronis.com/en/tru/posts/two-ways-to-scale-your-scripts/) Every script you run on a customer endpoint is operational software with administrator privileges. It deserves the same lifecycle discipline you would apply to any other production code — review, attribution, versioning and retirement. Whether a script was written by a senior engineer last Tuesday, cloned from a vendor template or generated by AI, the standards expectation is identical. 21 July 2026 ### [Lampion's Portugal-focused phishing campaign delivers multistage malware](https://www.acronis.com/en/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/) Acronis Threat Research Unit (TRU) has identified an active Lampion malware campaign targeting Portuguese users through phishing emails masquerading as financial and administrative communications. 14 July 2026 ### [Acronis Cyberthreats Update, July 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-july-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in June 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/) [2](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/) [3](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/) [4](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/) [5](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/) [6](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/6/) [7](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/7/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)