--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 23 March 2026 ### [MSP cybersecurity news digest, March 23, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-23-2026/) Interlock ransomware exploits a zero‑day flaw in Cisco firewall management infrastructure, Marquis confirms ransomware incident that exposed 672,000 individuals and impacted 74 banks, and more. Here are the latest threats to MSP security. 16 March 2026 ### [MSP cybersecurity news digest, March 16, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-16-2026/) Critical vulnerabilities in Veeam Backup and Replication put backup infrastructure at risk of RCE attacks, Microsoft resolves 79 vulnerabilities in March updates, including two zero days already disclosed publicly, and more. Here are the latest threats to MSP security. 09 March 2026 ### [MSP cybersecurity news digest, March 9, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-9-2026/) Malicious campaigns abuse OAuth redirect behavior to bypass phishing defenses and deliver malware, Google says threat actors abused 90 zero‑day flaws in 2025, many targeting core infrastructure systems. Here are the latest threats to MSP security. 03 March 2026 ### [MSP cybersecurity news digest, March 3, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-march-3-2026/) Trend Micro flags severe Apex One RCE flaws that could let attackers disable protection layers, ManoMano reports massive data breach affecting 38 million customer accounts, and more. Here are the latest threats to MSP security. 02 March 2026 ### [The patch reality gap: How fast SMBs really patch and what are the risks](https://www.acronis.com/en/tru/posts/the-patch-reality-gap-how-fast-smbs-really-patch-and-what-are-the-risks/) This report summarizes patch deployment behavior observed in Acronis telemetry during the second half of 2025. It focuses on patching for Microsoft and third-party applications, and on not whether patching can be done, but how fast patches are actually applied across all devices. 23 February 2026 ### [MSP cybersecurity news digest, February 23, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-february-23-2026/) Critical BeyondTrust pre‑auth RCE exploited in the wild, CISA demands immediate remediation, AI platforms like Copilot and Grok demonstrated as covert C2 proxies in new attack technique, and more. Here are the latest threats to MSP security. 23 February 2026 ### [OpenClaw: Agentic AI in the wild — Architecture, adoption and emerging security risks](https://www.acronis.com/en/tru/posts/openclaw-agentic-ai-in-the-wild-architecture-adoption-and-emerging-security-risks/) Over the past few weeks, OpenClaw has rapidly evolved from a niche open‑source project into one of the most widely discussed examples of agentic AI in practice. This combination of intelligence, autonomy and integration is precisely why OpenClaw has captured attention across developer and security communities. It is also why it has become a focal point for serious security concerns. 18 February 2026 ### [Acronis Cyberthreats Update, February 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-february-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in January 2026 and reflect threats that Acronis detected, as well as news stories from the public domain. 12 February 2026 ### [LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems](https://www.acronis.com/en/tru/posts/lockbit-strikes-with-new-50-version-targeting-windows-linux-and-esxi-systems/) The Acronis Threat Research Unit (TRU) analyzed the latest version of LockBit ransomware (version 5), which targets Windows, Linux and ESXi systems, and shares some similarities with the previous version 4. 10 February 2026 ### [Closing the execution gap: How Acronis supports MSPs in implementing Winter SHIELD controls](https://www.acronis.com/en/tru/posts/closing-the-execution-gap-how-acronis-supports-msps-in-implementing-winter-shield-controls/) Operation Winter SHIELD is an FBI Cyber Division initiative that has distilled theoretical best practices into ten concrete actions designed to reduce the likelihood of system compromise when attackers strike, and limit damage when incidents occur by focusing on controls that matter most in practice, not on paper. 09 February 2026 ### [MSP cybersecurity news digest, February 9, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-february-9-2026/) Russian-linked threat actors actively exploit newly patched Microsoft office zero day in targeted attacks, Fintech giant Betterment reports major data exposure affecting 1.4 million users, and more. Here are the latest threats to MSP security. 04 February 2026 ### [New year, new sector: Transparent Tribe targets India’s startup ecosystem](https://www.acronis.com/en/tru/posts/new-year-new-sector-transparent-tribe-targets-indias-startup-ecosystem/) Acronis Threat Research Unit (TRU) has been tracking Transparent Tribe, also known as APT36, and has uncovered a campaign that stands out for its use of startup-oriented, themed lure material delivered via an ISO container-based file. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/) [2](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/) [3](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/) [4](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/) [5](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/) [6](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/6/) [7](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/7/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)