--- title: Eliad Kimhy description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/kimhy-eliad/ locale: en last_updated: 2026-10-11 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Eliad Kimhy ![Image 1: Eliad Kimhy](https://staticfiles.acronis.com/images/content/18379bd36c152590b7173e0497504737.png) # Eliad Kimhy Senior TRU Researcher, Acronis Threat Research Unit (TRU) Eliad is focused on cybersecurity research, threat intelligence, and communicating findings through published reports, conference talks, and media engagements. Eliad has worked with security teams for close to a decade, helping build and lead the development of threat intelligence production, and the publication of research-based content for technical and general audiences. He is the co-creator and producer of the Webby Honoree podcast Malicious Life, which explores the history of cybersecurity. Eliad has spoken at conferences including Virus Bulletin, Insomnihack, Thotcon, BsidesSF, BsidesLV, and IT-SA. 17 March 2026 ### [Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit](https://www.acronis.com/en/tru/posts/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit/) Acronis TRU has identified hundreds of GitHub repositories delivering malware to video gamers under the guise of "free game cheats," spanning numerous campaigns across virtually every major online game title. 17 February 2026 ### [CRESCENTHARVEST: Iranian protestors and dissidents targeted in cyberespionage campaign](https://www.acronis.com/en/tru/posts/crescentharvest-iranian-protestors-and-dissidents-targeted-in-cyberespionage-campaign/) Acronis' Threat Research Unit (TRU) has uncovered a malware campaign, dubbed CRESCENTHARVEST, potentially targeting supporters of Iran's ongoing protests with the goal of information theft and long-term espionage. 25 November 2025 ### [Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix](https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/) Acronis TRU researchers have discovered an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of “Critical Windows Security Updates” to trick victims into executing malicious commands. 10 November 2025 ### [Acronis TRU Alliance {VirusTotal}: Tracking FileFix, Shadow Vector, and SideWinder](https://www.acronis.com/en/tru/posts/acronis-tru-alliance-virustotal-tracking-filefix-shadow-vector-and-sidewinder/) Introducing the Acronis TRU Alliance Series. This new series highlights collaborative research analysis between Acronis Threat Research Unit (TRU) and other leading threat intelligence teams. In this first post of our collaboration series, we’ve teamed up with VirusTotal (VT) to share practical insights from Acronis TRU on several recent reports. 04 November 2025 ### [The DragonForce Cartel: Scattered Spider at the gate](https://www.acronis.com/en/tru/posts/the-dragonforce-cartel-scattered-spider-at-the-gate/) Acronis Threat Research Unit (TRU) analyzed DragonForce, a Conti-derived ransomware-as-a-service active since 2023, documenting its malware, affiliate model and links to Scattered Spider. 16 September 2025 ### [FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography](https://www.acronis.com/en/tru/posts/filefix-in-the-wild-new-filefix-campaign-goes-beyond-poc-and-leverages-steganography/) Acronis' Threat Research Unit discovered a rare in-the-wild example of a FileFix attack — a new variant of the now infamous ClickFix attack vector. 03 September 2025 ### [Trojanized ScreenConnect installers evolve, dropping multiple RATs on a single machine](https://www.acronis.com/en/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/) Over the past months, Acronis TRU (Threat Research Unit) has identified multiple active and ongoing campaigns leveraging trojanized versions of ConnectWise ScreenConnect to gain initial access to victim networks and compromise target machines.