--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 13 July 2026 ### [Session recording adoption takes off](https://www.acronis.com/en/tru/posts/session-recording-adoption-takes-off/) Selective session recording is one of the oldest and cheapest controls in privileged-access security, and every regulatory framework that touches remote administration expects it. The control became generally available on the Acronis platform on April 22, 2026. This report measures the two months of adoption that followed, through June 23, 2026. 10 July 2026 ### [One admin equals one risk: Why cyber protection needs role-based control](https://www.acronis.com/en/tru/posts/one-admin-equals-one-risk-why-cyber-protection-needs-role-based-control/) The single most useful security control inside a cloud-protection platform is also the one that costs nothing to turn on: give each technician the narrowest role that fits the job. Role-based access control is not a user-experience nicety. It is the operational expression of three of the oldest and most universally agreed cybersecurity principles: least privilege, separation of duties and accountability. 28 June 2026 ### [Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON](https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/) Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector. 17 June 2026 ### [From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware](https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/) INC has evolved from an emerging ransomware-as-a-service (RaaS) operation into one of the most active ransomware groups in 2026, claiming more than 800 victims since 2023. 17 June 2026 ### [Acronis Cyberthreats Update, June 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-june-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in May 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. 03 June 2026 ### [Backup operations at scale: Turning "green" indicators into recovery readiness](https://www.acronis.com/en/tru/posts/backup-operations-at-scale-turning-green-indicators-into-recovery-readiness/) During disruptions — ransomware, outages or accidental deletions — what matters is whether recoverable points exist, how recent they are, and whether restores can be performed quickly and repeatedly under pressure. 01 June 2026 ### [Why most DR deployments may not survive a real disaster](https://www.acronis.com/en/tru/posts/why-most-dr-deployments-may-not-survive-a-real-disaster/) This report examines the disaster recovery (DR) readiness across the Acronis Cyber Platform platform, managing thousands of DR deployments across dozens of data centers worldwide. The analysis focuses on Q1 2026 (January – March) and reveals a clear gap between having DR configured and being truly ready for a disaster. 21 May 2026 ### [Automation and scripting in SMBs: Trends, challenges and what actually works](https://www.acronis.com/en/tru/posts/automation-and-scripting-in-smbs-trends-challenges-and-what-actually-works/) Most IT teams recognize the value of automation, yet in practice, many remain reactive, spending most of their time on tickets and outages rather than building automation. Organizations that benefit most from automation are not necessarily the ones that write the most scripts, but those that treat it as operational infrastructure and manage it with discipline. 15 May 2026 ### [Acronis Cyberthreats Update, May 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-may-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in April 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. 13 May 2026 ### [The remote access blind spot: An analysis of RMM tool risk for SMBs](https://www.acronis.com/en/tru/posts/the-remote-access-blind-spot-an-analysis-of-rmm-tool-risk-for-smbs/) Remote monitoring and management (RMM) tools are widely used in modern IT operations, but they are increasingly exploited by cybercriminals. Here, in this first blog, in a two-part series, we analyze the data to discover where RMM-associated risks lie. 05 May 2026 ### [MSP cyber protection news, May 5, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-may-5-2026/) SAP npm packages compromised in supply chain attack to steal developer and cloud credentials, GlassWorm campaign resurfaces via sleeper OpenVSX extensions that activate malicious payloads, and more. Here are the latest threats to MSP security. 30 April 2026 ### [Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw](https://www.acronis.com/en/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw/) Acronis TRU uncovered active abuse of AI platforms like Hugging Face and ClawHub for malware delivery, where attackers exploit trust in AI ecosystems and agents, and potentially trigger further malicious actions through AI-driven workflows. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/) [2](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/) [3](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/) [4](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/) [5](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/) [6](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/6/) [7](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/7/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)