--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/20/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 06 February 2023 ### [DoubleZero: A data wiper deployed against Ukraine](https://www.acronis.com/en/tru/posts/doublezero-a-data-wiper-deployed-against-ukraine/) The DoubleZero wiper — so named for its tactic of zeroing files — was first discovered on March 17, 2022 by CERT-UA (the Computer Emergency Response Team of Ukraine). The malware was designed in order to wipe out system files, non-system files and entire registry branches, and was spread by spear phishing emails with an attached ZIP that contains the malware file. 02 February 2023 ### [Vawtrak: A banking trojan with a long history](https://www.acronis.com/en/tru/posts/vawtrak-a-banking-trojan-with-a-long-history/) Vawtrak is a banking trojan — a form of malware that attempts to steal credentials from banks. It spreads via phishing emails and spam emails that contain a malicious document, loaded with a macro. The primary target of this malware are banks and insurance companies, mainly in Germany. 05 January 2023 ### [Royal ransomware’s actors make high demands](https://www.acronis.com/en/tru/posts/royal-ransomwares-actors-make-high-demands/) Royal ransomware was first spotted in January 2022, targeting different corporations. This group does not provide ransomware-as-a-service. The attackers demand figures ranging from $250,000 to over $2 million from their victims. 27 December 2022 ### [AV-Comparatives: Acronis Cyber Protect certified an Advanced Threat Prevention product for enterprise](https://www.acronis.com/en/tru/posts/av-comparatives-acronis-cyber-protect-certified-an-advanced-threat-prevention-product-for-enterprise/) Acronis Cyber Protect with the Advanced Security pack successfully passed the rigorous test criteria established by AV-Comparatives for their Advanced Threat Protection test, and was certified as an advanced threat prevention solution recommended for use by any business, including enterprise-level companies. 28 November 2022 ### [AXLocker ransomware doesn’t change files’ extensions](https://www.acronis.com/en/tru/posts/axlocker-ransomware-doesnt-change-files-extensions/) AXLocker is a ransomware that was found by malware researcher ‘S!ri,’ who posted it on Twitter. Later, it was discovered that AXLocker does not only encrypt files but also steals victims’ Discord credentials and uploads them to its own Discord server. Specifically, the AXLocker ransomware steals tokens stored on a local computer when the user logs in to Discord. It’s not packed or obfuscated. 25 November 2022 ### [Killnet ransomware — a wiper from the Chaos family](https://www.acronis.com/en/tru/posts/killnet-ransomware-a-wiper-from-the-chaos-family/) Killnet is a Russian hacker group, previously known for providing DDoS services. At the end of October 2022, the security channel PCrisk discovered the first sample of Killnet ransomware. The group, via a Telegram channel, also announced a ransomware attack on an Italian chemical factory. 13 October 2022 ### [AV-Comparatives: Acronis Cyber Platform earns 100% detection rate, zero false-positives](https://www.acronis.com/en/tru/posts/av-comparatives-acronis-cyber-protect-cloud-earns-100-detection-rate-zero-false-positives/) We’re proud to share that Acronis Cyber Platform with Advanced Security received excellent results in the latest AV-Comparatives Business Security Test, published on October 13, 2022. 10 October 2022 ### [CommonSpirit Health IT systems disrupted, ransomware suspected](https://www.acronis.com/en/tru/posts/commonspirit-health-it-systems-disrupted-ransomware-suspected/) CommonSpirit Health, one of the largest nonprofit hospitals in the US, has seemingly been hit by a cyberattack. The organization faced a disruption of its IT systems that led to some delays in patient care. 26 September 2022 ### [Hive ransomware gang claims several new major victims](https://www.acronis.com/en/tru/posts/hive-ransomware-gang-claims-several-new-major-victims/) The infamous Hive ransomware gang has been busy lately. Just in the last week, they've claimed responsibility for four new victims. 22 September 2022 ### [RapperBot: A new threat for IoT devices](https://www.acronis.com/en/tru/posts/rapperbot-a-new-threat-for-iot-devices/) On June 22, 2022, CNCERT IoT Threat Research Team and NSFOCUS FuYingLab monitored a new botnet that was attacking IoT devices. Naming the threat ‘RapperBot,’ researchers found more than 5,000 compromised hosts, but no attack commands were spotted. In analyzing samples, cybersecurity analytics found similarities with Mirai Bot, whose source code has been leaked. 13 September 2022 ### [Hotel giant IHG hit by cyberattack, bookings disrupted](https://www.acronis.com/en/tru/posts/hotel-giant-ihg-hit-by-cyberattack-bookings-disrupted/) Leading hospitality company InterContinental Hotels Group PLC (also known as IHG Hotels & Resorts) has been impacted by a cyberattack. The hotel group's APIs are down and showing 502 and 503 HTTP errors, while customers are unable to log into their accounts. 12 September 2022 ### [Instagram phishing campaign dangles "blue badges" as lure](https://www.acronis.com/en/tru/posts/instagram-phishing-campaign-dangles-blue-badges-as-lure/) A new Instagram phishing campaign has been discovered, attempting to scam users of the popular social media platform by luring them with the offer of a coveted "blue badge" — official verification of the user's profile. As part of the alleged verification process, users are asked to reveal their password and other sensitive information, all of which is sent directly to the attacker. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/)...[18](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/18/) [19](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/19/) [20](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/20/) [21](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/21/) [22](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/22/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)