--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/18/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 26 October 2023 ### [Acronis Cyber Platform once again excels in AV-Test Advanced Protection evaluation](https://www.acronis.com/en/tru/posts/acronis-cyber-protect-once-again-excels-in-av-test-advanced-protection-evaluation/) In an evaluation performed in May–June by well-known German testing laboratory AV-Test, Acronis Cyber Platform with Advanced Security achieved a perfect score. Acronis Cyber Platform blocked 10 out of 10 advanced threats crafted by laboratory experts to test the ability of security products to manage with new and unknown threats. 25 October 2023 ### [Ursnif, the banking trojan](https://www.acronis.com/en/tru/posts/ursnif-the-banking-trojan/) Ursnif, also known as Gozi or Dreambot, is a banking trojan. Ursnif is typically delivered via phishing emails that contain malicious attachments or links. There has been a surge of Ursnif campaigns led by different individuals with no relation to one another. These campaigns resulted in successful attacks on several Italian banks, stealing user credentials and gathering information from compromised networks. 17 October 2023 ### [Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/) Nokoyawa ransomware was first discovered in February 2022, and it initially shared similarities to the Hive ransomware. As this threat has evolved, it's become more dangerous, and appears to have claimed numerous victims already. 06 October 2023 ### [Acronis Cyberthreats Update, October 2023](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2023/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in September of this year and reflect threats that we detected as well as news stories from the public domain. 02 October 2023 ### [BlackByte 3.0 uses vulnerable drivers to compromise systems](https://www.acronis.com/en/tru/posts/blackbyte-30-uses-vulnerable-drivers-to-compromise-systems/) BlackByte is an example of ‘ransomware-as-a-service‘ (RaaS), and the threat actors behind it constantly upgrade their malware to keep customers satisfied. Recent changes have increased the complexity of cybersecurity analytics, while also introducing new anti-analysis and anti-debugging techniques. 08 September 2023 ### [Acronis Cyberthreats Update, September 2023](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-september-2023/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in August of this year and reflect threats that we detected as well as news stories from the public domain. 08 August 2023 ### [Acronis Cyberthreats Report, August 2023](https://www.acronis.com/en/tru/posts/acronis-cyberthreat-reports-august-2023/) The Acronis Cyberthreats Report covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in July of this year and reflect threats that we detected as well as news stories from the public domain. 04 August 2023 ### [AV-TEST: Another top score for Acronis Cyber Protect in macOS evaluation](https://www.acronis.com/en/tru/posts/av-test-another-top-score-for-acronis-cyber-protect-in-macos-evaluation/) Acronis Cyber Platform with Advanced Security has once again been evaluated by the renowned independent German testing laboratory AV-TEST. Just as in previous evaluations, the solution received a perfect score of 18/18 points. These consistently perfect results, despite an ever-evolving threat landscape, are demonstrative proof that Acronis Cyber Platform is well-equipped to protect macOS users. 02 August 2023 ### [Acronis Cyber Protect again scores top marks in AV-TEST evaluation](https://www.acronis.com/en/tru/posts/acronis-cyber-protect-again-scores-top-marks-in-av-test-evaluation/) AV-TEST, the renowned independent evaluator of antivirus and security solutions, has recognized Acronis Cyber Protect for its flawless results in protecting against the latest attack techniques. The organization’s latest Advanced Threat Protection test took place in March–April. In this evaluation, AV-TEST specialists were testing resilience against a particular attack technique: the "Inline Execute Assembly." 21 July 2023 ### [8Base ransomware activity surges in U.S. and Brazil](https://www.acronis.com/en/tru/posts/8base-ransomware-activity-surges-in-us-and-brazil/) Researchers have reported that the 8Base ransomware, which operated covertly for over a year, exhibited a significant increase in activity in May and June 2023. Employing encryption and "name-and-shame" tactics, 8Base targets victims across diverse industries. It has been linked to 67 attacks, primarily affecting businesses in the U.S. and Brazil. 20 July 2023 ### [Trojanized Super Mario Bros installer spreads malware](https://www.acronis.com/en/tru/posts/trojanized-super-mario-bros-installer-spreads-malware/) Researchers have discovered a Trojanized Super Mario Bros game installer that delivers multiple forms of malware, including an XMR miner, SupremeBot mining client and Umbral Stealer. 19 July 2023 ### [Siemens Energy confirms data breach after MOVEit attack](https://www.acronis.com/en/tru/posts/siemens-energy-confirms-data-breach-after-moveit-attack/) Siemens Energy, a Munich-based energy technology company with a revenue of €32 billion, has confirmed that their data was stolen in the recent Clop ransomware data-theft attacks, which exploited a zero-day vulnerability in the MOVEit Transfer platform. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/)...[16](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/16/) [17](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/17/) [18](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/18/) [19](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/19/) [20](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/20/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)