--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/21/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 01 September 2022 ### [LockBit gang plans triple-extortion tactics](https://www.acronis.com/en/tru/posts/lockbit-gang-plans-triple-extortion-tactics/) The LockBit ransomware gang has announced that it is working to take its operation to the triple-extortion level. The gang is now looking to add DDoS as an extortion tactic on top of encrypting data and exfiltrating it (to threaten future leaks). 01 September 2022 ### [Library services firm Baker & Taylor hit by ransomware](https://www.acronis.com/en/tru/posts/library-services-firm-baker-and-taylor-hit-by-ransomware/) Baker & Taylor, the world's largest distributor of books to libraries worldwide, confirmed it's still working on restoring systems after being hit by ransomware more than a week ago. With an annual revenue of $4.6 billion, the Charlotte, North Carolina-based firm currently services more than 5,000 public and academic libraries. 29 August 2022 ### [Quantum ransomware attack hits Dominican Republic government agency](https://www.acronis.com/en/tru/posts/quantum-ransomware-attack-hits-dominican-republic-government-agency/) The Dominican Republic's Instituto Agrario Dominicano (IAD) has suffered a ransomware attack by the Quantum group. According to the ransom note, at least four physical servers and eight virtual servers with the databases, applications and emails were compromised. 29 August 2022 ### [Bombardier Recreational Products hit by RansomEXX gang](https://www.acronis.com/en/tru/posts/bombardier-recreational-products-hit-by-ransomexx-gang/) The RansomEXX ransomware gang is claiming responsibility for the cyberattack against Bombardier Recreational Products (BRP), which was disclosed by the company on August 8, 2022. 16 August 2022 ### [Hydrox: A new wiper attacks](https://www.acronis.com/en/tru/posts/hydrox-a-new-wiper-attacks/) Hydrox was first spotted by Twitter user Petrovich on July 29, 2022. On August 3, EnigmaSoft described this threat as a harmful malware that actually wipes users' data. This conclusion was made from a “ransom note” which didn’t actually contain any credentials or links for paying the ransom. 15 August 2022 ### [Cisco breached in Yanluowang ransomware attack, 2.8 GB data stolen](https://www.acronis.com/en/tru/posts/cisco-breached-in-yanluowang-ransomware-attack-28-gb-data-stolen/) Multi-national tech conglomerate Cisco has confirmed that the Yanluowang ransomware gang breached its corporate network in late May, and that the group tried to extort them by threatening to leak stolen files online. The Yanluowang gang claims to have stolen 2.8 GB of data, consisting of approximately 3,100 files which Cisco has described as "not sensitive." 08 August 2022 ### [Electronics manufacturer Semikron hit by LV ransomware](https://www.acronis.com/en/tru/posts/electronics-manufacturer-semikron-hit-by-lv-ransomware/) German electronics manufacturer Semikron has reported that they were hit by a ransomware attack. The LV ransomware group has claimed responsibility for this attack, and is threatening to leak 2 TB worth of stolen data if their ransom demands are not met. 05 August 2022 ### [European pipeline operator hit by BlackCat/ALPHV ransomware](https://www.acronis.com/en/tru/posts/european-pipeline-operator-hit-by-blackcat-alphv-ransomware/) The ALPHV/BlackCat ransomware gang claims to have stolen more than 150 GB of data from Creos Luxembourg S.A., a company which manages natural gas pipelines and electrical networks in the Grand Duchy of Luxembourg. The alleged stolen data consists of 180,000 files, including contracts, agreements, passports, bills and emails. 05 August 2022 ### [New attack framework Manjusaka is similar to Cobalt Strike](https://www.acronis.com/en/tru/posts/new-attack-framework-manjusaka-is-similar-to-cobalt-strike/) Researchers have observed a new post-exploitation attack framework in the wild. Manjusaka, as it's called, can be deployed as an alternative to the popular Cobalt Strike toolset ⁠— or parallel to it for redundancy. 29 July 2022 ### [QBot malware uses Windows Calculator to side-load attacks](https://www.acronis.com/en/tru/posts/qbot-malware-uses-windows-calculator-to-side-load-attacks/) Security researchers have discovered that QBot malware is now using the legitimate Windows Calculator app for DLL side-loading attacks. The method continues to be used in current malspam campaigns. 27 July 2022 ### [Version 4.2 of malicious shortcut generator MLNK Builder emerges on dark web](https://www.acronis.com/en/tru/posts/version-42-of-malicious-shortcut-generator-mlnk-builder-emerges-on-dark-web/) A new version of MLNK Builder, a link generation tool popular among cybercriminals, has emerged on the dark web. The updated feature set focuses on antivirus evasion and masquerading techniques, using icons of popular legitimate applications and file formats. 26 July 2022 ### [Symbiote: A new stealthy malware for Linux](https://www.acronis.com/en/tru/posts/symbiote-a-new-stealthy-malware-for-linux/) Symbiote is a new Linux malware that steals users’ data and provides a backdoor to threat actors. It was discovered in June, 2022 and is characterized as a very stealthy malware. It uses a lot of evasion techniques, such as hooking functions, capturing TCP traffic and hiding its own files. It collects users' data and exfiltrates it on DNS servers. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/)...[19](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/19/) [20](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/20/) [21](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/21/) [22](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/22/) [23](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/23/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)