--- title: Acronis Threat Research Unit description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Acronis Threat Research Unit ![Image 1: Acronis Threat Research Unit](https://staticfiles.acronis.com/images/content/d8af6fc5b7ea4b37af377b4993c2a572.png) # Acronis Threat Research Unit Threat Research Unit is a dedicated Acronis unit composed of experienced cybersecurity experts. Our team includes cross-functional experts in cybersecurity, AI, and threat intelligence. We are empowering IT teams with intelligence-driven cyberthreat research and reporting. 03 February 2026 ### [MSP cybersecurity news digest, February 3, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-february-3-2026/) Unsecured MongoDB databases remain easy targets for data exfiltration and extortion campaigns, ShinyHunters’ leak claims prompt Match Group to confirm limited data exposure event, and more. Here are the latest threats to MSP security. 03 February 2026 ### [MSP cybersecurity news digest, January 27, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-january-27-2026/) AI‑built VoidLink malware emerges with advanced loaders, rootkits and modular attack capabilities, Active attacks leverage telnetd authentication bypass flaw (CVE‑2026‑24061) to obtain instant root access, and more. Here are the latest threats to MSP security. 20 January 2026 ### [MSP cybersecurity news digest, January 20, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-january-20-2026/) Grubhub admits breach after hackers access internal systems and exfiltrate sensitive data, France’s Free Mobile hit with €42 million CNIL penalty for security failures in massive 2024 data breach, and more. Here are the latest threats to MSP security. 16 January 2026 ### [Acronis Cyberthreats Update, January 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-january-2026/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in December 2025 and reflect threats that Acronis detected, as well as news stories from the public domain. 15 January 2026 ### [LOTUSLITE: Targeted espionage leveraging geopolitical themes](https://www.acronis.com/en/tru/posts/lotuslite-targeted-espionage-leveraging-geopolitical-themes/) Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious DLL. The executable is used to sideload and execute the DLL, which functions as the primary backdoor, tracked as LOTUSLITE. 12 January 2026 ### [MSP cybersecurity news digest, January 12, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-january-12-2026/) ClickFix campaigns use fake BSOD screens to trick users into running malware, Newly disclosed Veeam issues highlight ongoing risks to backup infrastructure, and more. Here are the latest threats to MSP security. 08 January 2026 ### [Boto-Cor-de-Rosa campaign reveals Astaroth WhatsApp-based worm activity in Brazil](https://www.acronis.com/en/tru/posts/boto-cor-de-rosa-campaign-reveals-astaroth-whatsapp-based-worm-activity-in-brazil/) In a newly identified campaign, internally referred to as Boto Cor-de-Rosa, our researchers discovered that Astaroth now exploits WhatsApp Web as part of its propagation strategy. 05 January 2026 ### [MSP cybersecurity news digest, January 5, 2026](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-january-5-2026/) Fake KMSAuto activators spread malware tied to large-scale crypto losses, Zoom-themed browser extensions steal corporate meeting data at scale, and more. Here are the latest threats to MSP security. 31 December 2025 ### [Acronis Cyberthreats Update, December 2025](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-december-2025/) The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in November 2025 and reflect threats that Acronis detected, as well as news stories from the public domain. 29 December 2025 ### [MSP cybersecurity news digest, December 29, 2025](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-december-29-2025/) Active exploitation of “MongoBleed” flaw exposes data from over 87,000 servers, Patch released for high-severity RCE issue in n8n workflows, and more. Here are the latest threats to MSP security. 26 December 2025 ### [MSP cybersecurity news digest, December 22, 2025](https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-december-22-2025/) Cyberattack on email services confirmed by France’s Interior Ministry, Maximum-severity RCE flaw disclosed in HPE OneView, and more. Here are the latest threats to MSP security. 18 December 2025 ### [Acronis TRU Alliance {Hunt.io}: Hunting DPRK threats - New Global Lazarus & Kimsuky campaigns](https://www.acronis.com/en/tru/posts/acronis-tru-alliance-huntio-hunting-dprk-threats-new-global-lazarus-and-kimsuky-campaigns/) This report is the result of a collaborative investigation between Hunt.io and the Acronis Threat Research Unit (TRU), in which both teams collaborated to map ongoing DPRK infrastructure activity, including Lazarus and Kimsuky. [1](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/1/) [2](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/2/) [3](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/3/) [4](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/4/) [5](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/5/) [6](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/6/) [7](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/7/)...[27](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/page/27/)