--- title: Browse articles in Security Research description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/categories/security-research/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Security Research # Browse articles in Security Research 21 October 2026 ### [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. 26 August 2026 ### [Cambodia-focused cluster uses multistage infection chain with localized lures](https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/) Acronis’ Threat Research Unit (TRU) identified a recent campaign focused on Cambodia. The analyzed archives, discovered while hunting for related activity, use several lure themes, including Cambodian government notices, public health announcements, dental examination records, real estate documents, and promotional offers. 19 August 2026 ### [Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign](https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/) Grandoreiro is a notorious banking trojan that has been operating across Latin America since at least 2016, targeting financial institutions and their customers through phishing campaigns and social engineering techniques. Written in Delphi and Brazilian in origin, it is one of the many of Latin American banking trojans (alongside Guildma, Javali and Melcoz). 13 August 2026 ### [PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure](https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/) Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. 21 July 2026 ### [Lampion's Portugal-focused phishing campaign delivers multistage malware](https://www.acronis.com/en/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/) Acronis Threat Research Unit (TRU) has identified an active Lampion malware campaign targeting Portuguese users through phishing emails masquerading as financial and administrative communications. 28 June 2026 ### [Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON](https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/) Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector. 17 June 2026 ### [From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware](https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/) INC has evolved from an emerging ransomware-as-a-service (RaaS) operation into one of the most active ransomware groups in 2026, claiming more than 800 victims since 2023. 10 June 2026 ### [Behind Khmer Shadow: Targeted espionage against Cambodian government entities](https://www.acronis.com/en/tru/posts/behind-khmer-shadow-targeted-espionage-against-cambodian-government-entities/) Acronis Threat Research Unit (TRU) has identified two espionage-focused campaigns targeting Cambodian government entities in the defense and public works sectors. TRU has assessed with moderate confidence that the activity is espionage-motivated and likely aligned with regional intelligence collection interests in Southeast Asia. 30 April 2026 ### [Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw](https://www.acronis.com/en/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw/) Acronis TRU uncovered active abuse of AI platforms like Hugging Face and ClawHub for malware delivery, where attackers exploit trust in AI ecosystems and agents, and potentially trigger further malicious actions through AI-driven workflows. 21 April 2026 ### [Same packet, different magic: Mustang Panda hits India's banking sector and Korea geopolitics](https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/) Acronis Threat Research Unit (TRU) identified a new variant of the LOTUSLITE backdoor with a theme related to India's banking sector, delivered via DLL sideloading using a legitimate Microsoft-signed executable. 17 March 2026 ### [Vidar Stealer 2.0 distributed via fake game cheats on GitHub and Reddit](https://www.acronis.com/en/tru/posts/vidar-stealer-20-distributed-via-fake-game-cheats-on-github-and-reddit/) Acronis TRU has identified hundreds of GitHub repositories delivering malware to video gamers under the guise of "free game cheats," spanning numerous campaigns across virtually every major online game title. 06 March 2026 ### [Mobile spyware campaign impersonates Israel's Red Alert rocket warning system](https://www.acronis.com/en/tru/posts/mobile-spyware-campaign-impersonates-israels-red-alert-rocket-warning-system/) Acronis Threat Research Unit (TRU) has identified a targeted campaign distributing a trojanized version of the Red Alert rocket warning Android app to Israeli users via SMS messages impersonating official Home Front Command communications. [1](https://www.acronis.com/en/tru/categories/security-research/page/1/) [2](https://www.acronis.com/en/tru/categories/security-research/page/2/) [3](https://www.acronis.com/en/tru/categories/security-research/page/3/) [4](https://www.acronis.com/en/tru/categories/security-research/page/4/) [5](https://www.acronis.com/en/tru/categories/security-research/page/5/) [6](https://www.acronis.com/en/tru/categories/security-research/page/6/) [7](https://www.acronis.com/en/tru/categories/security-research/page/7/)...[15](https://www.acronis.com/en/tru/categories/security-research/page/15/)