--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 27 August 2021 ### [FBI issues FLASH alert about OnePercent ransomware group](https://www.acronis.com/en/tru/posts/fbi-issues-flash-alert-about-onepercent-ransomware-group/) In a first for the FBI, their Cyber Division has released a FLASH alert to warn about a ransomware affiliate. The cybercriminals in question are the OnePercent Group, which has operated since at least November 2020 and has ties to the REvil, Maze, and Egregor extortion gangs. 05 June 2021 ### [JBS attack shows the immense threat posed by ransomware](https://www.acronis.com/en/tru/posts/jbs-attack-shows-immense-threat-posed-ransomware/) The world’s largest meat supplier, JBS, was forced to halt operations at many of its U.S. and Australian processing plants after a massive cyberattack. This activity threatened supply chains across the world, and resulted in an immediate rise in wholesale red meat prices. This cyberattack, while notable in its own right, is also simply the latest example in a dangerous pattern of escalating ransomware hazards. 19 May 2021 ### [New attack vectors for the DarkSide ransomware gang](https://www.acronis.com/en/tru/posts/new-attack-vectors-for-the-darkside-ransomware-gang/) DarkSide stands out from other ransomware as a service (RaaS) threats, as one of its attack vectors is based on the Zloader botnet (also known as “Silent Night”). It has also been delivered through compromised third-party service providers. 10 May 2021 ### [DarkSide ransomware attack on Colonial Pipeline cripples energy infrastructure](https://www.acronis.com/en/tru/posts/darkside-ransomware-attack-colonial-pipeline-cripples-energy-infrastructure/) In the latest incident that illustrates the overlap of the traditional economy and infrastructure with the digital realities of modern business, one of the largest pipelines in the U.S. was forced to shut down this past weekend after being hit by a ransomware group. Managed by Colonial Pipeline Co., the 5,500-mile pipeline runs across 14 states between Houston, TX and New York Harbor, and provides around 45% of all fuel for the U.S. East Coast. 27 April 2021 ### [DearCry ransomware exploits Exchange server vulnerability](https://www.acronis.com/en/tru/posts/dearcry-ransomware-exploits-exchange-server-vulnerability/) DearCry ransomware uses the recently disclosed zero-day ProxyLogon vulnerabilities to hack into Microsoft Exchange servers. Its file encryption scheme leaves no chance of decryption without the correct key, and data overwriting techniques may complicate recovery. The first DearCry attack was discovered on March 9, 2021. 03 March 2021 ### [Cl0p ransomware returns with better self-defense and bypass techniques](https://www.acronis.com/en/tru/posts/cl0p-ransomware-returns-with-better-self-defense-and-bypass-techniques/) In February 2021, the public was shocked by the news of the hacking of Bombardier, a giant in the aerospace industry. During the investigation of the incident, analysts established that the threat group TA505, using the Cl0p ransomware, were responsible for the attack. 23 December 2020 ### [Defending against supply chain attacks like the SolarWinds breach](https://www.acronis.com/en/tru/posts/defending-against-supply-chain-attacks-solarwinds-breach/) The success of the massive SolarWinds supply-chain attack presents an urgent new cybersecurity challenge to every business. We plumb the tactics used in the SolarWinds breach and show how Acronis defends against it and similar attacks. 12 October 2020 ### [New WastedLocker ransomware targets U.S.-based organizations](https://www.acronis.com/en/tru/posts/new-wastedlocker-ransomware-targets-us-based-organizations/) WastedLocker ransomware was supposedly used by the Evil Corp group, which is known to have delivered Dridex banking malware to attack at least 31 U.S.-based corporations since May 2020. Here we provide an in-depth analysis of WastedLocker, which employs numerous defensive evasion techniques such as digital signing, DLL side-loading, auto-elevation and alternate data streams . 20 September 2020 ### [Nefilim ransomware uses Citrix vulnerability to compromise victims’ machines](https://www.acronis.com/en/tru/posts/nefilim-ransomware-uses-citrix-vulnerability-to-compromise-victims-machines/) The Nefilim ransomware group, known to be active since February 2020, adopts the Nemty ransomware code written in the Delphi programming language. It uses a Citrix vulnerability/RDP to access corporate networks. Nefilim started its own data leak site called ‘Corporate Leaks,’ where the operators publish exfiltrated data from compromised organizations if they refuse to pay. 16 September 2020 ### [SunCrypt adopts attacking techniques from NetWalker and Maze ransomware](https://www.acronis.com/en/tru/posts/suncrypt-adopts-attacking-techniques-netwalker-and-maze-ransomware/) The SunCrypt ransomware family was first spotted in October 2019, but it was not very active at that time. The group behind it was independent in the beginning, but they recently joined the so-called Maze cartel – combining forces to rob individuals and companies around the world. This cartel included Maze and LockBit when it first started, but later welcomed Ragnar Locker and now SunCrypt. 21 August 2020 ### [NetWalker leverages obfuscated PowerShell to start C# injector](https://www.acronis.com/en/tru/posts/netwalker-leverages-obfuscated-powershell-to-start-c-injector1/) NetWalker ransomware was discovered in August 2019 in the wild. It implements a ransomware-as-a-service model, targeting both organizations and individual users. Since March 2020, the operators have managed to extort approximately $25 million. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/)...[21](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/21/) [22](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/22/) [23](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/23/) [24](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/24/) [25](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/25/) [26](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/26/) [27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)