April 21, 2026
Same packet, different magic: Mustang Panda hits India's banking sector and Korea geopolitics
Acronis Threat Research Unit (TRU) identified a new variant of the LOTUSLITE backdoor with a theme related to India's banking sector, delivered via DLL sideloading using a legitimate Microsoft-signed executable.
March 06, 2026
Mobile spyware campaign impersonates Israel's Red Alert rocket warning system
Acronis Threat Research Unit (TRU) has identified a targeted campaign distributing a trojanized version of the Red Alert rocket warning Android app to Israeli users via SMS messages impersonating official Home Front Command communications.
February 17, 2026
CRESCENTHARVEST: Iranian protestors and dissidents targeted in cyberespionage campaign
Acronis' Threat Research Unit (TRU) has uncovered a malware campaign, dubbed CRESCENTHARVEST, potentially targeting supporters of Iran's ongoing protests with the goal of information theft and long-term espionage.
February 04, 2026
New year, new sector: Transparent Tribe targets India’s startup ecosystem
Acronis Threat Research Unit (TRU) has been tracking Transparent Tribe, also known as APT36, and has uncovered a campaign that stands out for its use of startup-oriented, themed lure material delivered via an ISO container-based file.
January 15, 2026
LOTUSLITE: Targeted espionage leveraging geopolitical themes
Acronis Threat Research Unit (TRU) observed a targeted malware campaign against U.S. government entities leveraging a politically themed ZIP archive containing a loader executable and a malicious DLL. The executable is used to sideload and execute the DLL, which functions as the primary backdoor, tracked as LOTUSLITE.