--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 27 April 2026 ### [MSP cyber protection news, April 27, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-27-2026/) UNC6692 abused Microsoft Teams interactions to deliver the Snow malware toolkit, Bitwarden confirmed a short-lived supply chain compromise affecting its CLI npm package, and more. Here are the latest threats to MSP security. 24 April 2026 ### [How scheduling defaults and off-hours blindness are silently degrading backup reliability](https://www.acronis.com/en/tru/posts/how-scheduling-defaults-and-off-hours-blindness-are-silently-degrading-backup-reliability/) Data backup is the last line of defense for any organization. Industry research shows that 60% of small-to-medium enterprises that suffer a major data loss event go out of business within six months. Backup is simultaneously the most critical and most neglected operational function in small-to-medium business IT. 21 April 2026 ### [Same packet, different magic: Mustang Panda hits India's banking sector and Korea geopolitics](https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/) Acronis Threat Research Unit (TRU) identified a new variant of the LOTUSLITE backdoor with a theme related to India's banking sector, delivered via DLL sideloading using a legitimate Microsoft-signed executable. 20 April 2026 ### [Acronis Cyberthreats Update, April 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-april-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in March 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. 20 April 2026 ### [MSP cyber protection news, April 20, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-20-2026/) Payouts King ransomware uses hidden QEMU virtual machines to evade endpoint detection, New AgingFly malware campaign compromises public sector and health care systems in Ukraine, and more. Here are the latest threats to MSP security. 16 April 2026 ### [Backup retry storms: How you can improve backup reliability](https://www.acronis.com/en/tru/posts/backup-retry-storms-how-you-can-improve-backup-reliability/) Backup reliability is judged by whether recovery points are actually available when needed, not by whether a platform offers a retry button. The right response to a persistent backup failure is investigation and remediation, not more retries. 14 April 2026 ### [New JanaWare ransomware targets Turkey via Adwind RAT](https://www.acronis.com/en/tru/posts/new-janaware-ransomware-targets-turkey-via-adwind-rat/) The Acronis TRU team identified a threat cluster leveraging a customized Adwind (Java RAT) variant with polymorphic characteristics to deliver a ransomware module, tracked as ‘JanaWare.' Analysis of malware samples, infrastructure and telemetry indicates the campaign is likely focused on Turkish users. 13 April 2026 ### [MSP cyber protection news, April 13, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-13-2026/) Medusa‑linked Storm‑1175 conducts fast‑moving attacks that escalate quickly to ransomware, Iran‑linked actors launch widespread password spraying attacks against Microsoft 365 accounts, and more. Here are the latest threats to MSP security. 09 April 2026 ### [Immutable backups: The critical gap between backup success and real recovery readiness](https://www.acronis.com/en/tru/posts/immutable-backups-the-critical-gap-between-backup-success-and-real-recovery-readiness/) Backups were once judged by a single question: Did the job succeed? That is no longer enough. In a ransomware event, the more important question is whether the attacker can delete or change the recovery points before the business starts to recover. Immutable backup storage addresses that exact problem by making a protected backup copy impossible to delete or overwrite for a defined number of days. 07 April 2026 ### [MSP cybersecurity news digest, April 7, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-april-7-2026/) CareCloud confirms patient data theft after cyberattack disrupted health care systems, Google issues out‑of‑band patch for yet another Chrome zero day under active exploitation, and more. These are the latest threats to MSP security. 30 March 2026 ### [MSP cybersecurity news digest, March 30, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-30-2026/) Actively exploited Langflow vulnerability allows attackers to hijack exposed AI workflows, Smart Slider 3 vulnerability exposes sensitive server files on hundreds of thousands of WordPress sites, and more. These are the latest threats to MSP security. 25 March 2026 ### [Acronis Cyberthreats Update, March 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-march-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in February 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/) [2](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/) [3](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/) [4](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/) [5](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/) [6](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/6/) [7](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/7/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)