--- title: Darrel Virtusio description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/authors/virtusio-darrel/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Darrel Virtusio ![Image 1: Darrel Virtusio](https://staticfiles.acronis.com/images/content/a399c750955218b49a2a944575bbdada.png) # Darrel Virtusio TRU Researcher, Acronis Threat Research Unit (TRU) Darrel is a cybersecurity professional with hands-on experience in threat research. He began his career training in malware analysis and reverse engineering at Trend Micro. He later specialized in threat hunting, contributing to the discovery of emerging ransomware threats and monitoring ransomware groups, identifying open-source red team tools, developing threat hunting queries, and publishing research blogs. Darrell joined Acronis to continue his work and further develop his career in threat research. 21 October 2026 ### [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. 03 September 2026 ### [Remote access hardening playbook: Reducing RMM tool risk for SMBs](https://www.acronis.com/en/tru/posts/remote-access-hardening-playbook-reducing-rmm-tool-risk-for-smbs/) Widely trusted tools like ConnectWise ScreenConnect and AnyDesk may be abused by attackers, and when left unattended, they can present a problem: Their legitimate prevalence makes attacker activity harder to spot, and any vulnerabilities affecting them can turn a trusted platform into an infection vector. 26 August 2026 ### [Cambodia-focused cluster uses multistage infection chain with localized lures](https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/) Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. 13 August 2026 ### [PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure](https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/) Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. 17 March 2026 ### [Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit](https://www.acronis.com/en/tru/posts/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit/) Acronis TRU has identified hundreds of GitHub repositories delivering malware to video gamers under the guise of "free game cheats," spanning numerous campaigns across virtually every major online game title. 17 February 2026 ### [CRESCENTHARVEST: Iranian protestors and dissidents targeted in cyberespionage campaign](https://www.acronis.com/en/tru/posts/crescentharvest-iranian-protestors-and-dissidents-targeted-in-cyberespionage-campaign/) Acronis' Threat Research Unit (TRU) has uncovered a malware campaign, dubbed CRESCENTHARVEST, potentially targeting supporters of Iran's ongoing protests with the goal of information theft and long-term espionage. 08 December 2025 ### [Makop ransomware: GuLoader and privilege escalation in attacks against Indian businesses](https://www.acronis.com/en/tru/posts/makop-ransomware-guloader-and-privilege-escalation-in-attacks-against-indian-businesses/) Makop, a ransomware strain derived from Phobos, continues to exploit exposed RDP systems while adding new components such as local privilege escalation exploits and loader malware to its traditional toolkit. 19 November 2025 ### [Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads](https://www.acronis.com/en/tru/posts/cooking-up-trouble-how-tamperedchef-uses-signed-apps-to-deliver-stealthy-payloads/) Acronis Threat Research Unit (TRU) observed a global malvertising / SEO campaign, tracked as “TamperedChef.” It delivers legitimate-looking installers that disguise as common applications to trick users into installing them, establish persistence and deliver obfuscated JavaScript payloads for remote access and control. 04 November 2025 ### [The DragonForce Cartel: Scattered Spider at the gate](https://www.acronis.com/en/tru/posts/the-dragonforce-cartel-scattered-spider-at-the-gate/) Acronis Threat Research Unit (TRU) analyzed DragonForce, a Conti-derived ransomware-as-a-service active since 2023, documenting its malware, affiliate model and links to Scattered Spider.