--- title: Browse articles in Security Research description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/categories/security-research/page/3/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Security Research # Browse articles in Security Research 16 September 2025 ### [FileFix in the wild! New FileFix campaign goes beyond POC and leverages steganography](https://www.acronis.com/en/tru/posts/filefix-in-the-wild-new-filefix-campaign-goes-beyond-poc-and-leverages-steganography/) Acronis' Threat Research Unit discovered a rare in-the-wild example of a FileFix attack — a new variant of the now infamous ClickFix attack vector. 03 September 2025 ### [Trojanized ScreenConnect installers evolve, dropping multiple RATs on a single machine](https://www.acronis.com/en/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/) Over the past months, Acronis TRU (Threat Research Unit) has identified multiple active and ongoing campaigns leveraging trojanized versions of ConnectWise ScreenConnect to gain initial access to victim networks and compromise target machines. 04 August 2025 ### [MSPs a top target for Akira and Lynx ransomware](https://www.acronis.com/en/tru/posts/msps-a-top-target-for-akira-and-lynx-ransomware/) Acronis Threat Research Unit (TRU) analyzed recent samples of Akira and Lynx ransomware families to see the latest changes and tweaks implemented by the groups. 23 July 2025 ### [Threat actors go gaming: Electron-based stealers in disguise](https://www.acronis.com/en/tru/posts/threat-actors-go-gaming-electron-based-stealers-in-disguise/) The Acronis Threat Research Unit (TRU) uncovered a new malware campaign involving Leet Stealer, RMC Stealer (a modified version of Leet Stealer) and Sniffer Stealer. 08 July 2025 ### [SafePay ransomware: The fast-rising threat targeting MSPs](https://www.acronis.com/en/tru/posts/safepay-ransomware-the-fast-rising-threat-targeting-msps/) SafePay ransomware group has quietly and aggressively built momentum in Q1 2025, striking over 200 victims worldwide, including MSPs and SMBs. 18 June 2025 ### [Shadow Vector targets Colombian users via privilege escalation and court-themed SVG decoys](https://www.acronis.com/en/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/) The Acronis Threat Research Unit (TRU) identified an ongoing malware campaign named Shadow Vector that is actively targeting users in Colombia through malicious SVG files masquerading as urgent court notifications. 04 June 2025 ### [From open source to open threat: Tracking Chaos RAT’s evolution](https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/) Chaos RAT is an open-source remote administration tool (RAT) first seen in 2022. It evolved in 2024, and new samples have been discovered by TRU in 2025. 20 May 2025 ### [From banks to battalions: SideWinder’s attacks on South Asia’s public sector](https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/) Acronis Threat Research Unit (TRU) uncovered a new SideWinder APT campaign targeting high-level government institutions in Sri Lanka, Bangladesh and Pakistan. 15 April 2025 ### [Astaroth unleashed](https://www.acronis.com/en/tru/posts/astaroth-unleashed/) Astaroth, also known as Guildma, is a sophisticated piece of malware that first emerged in 2018 and has since undergone significant evolution, adapting to new security measures and refining its attack methodologies. 13 February 2025 ### [Advancements in delivery: Scripting with Nietzsche](https://www.acronis.com/en/tru/posts/advancements-in-delivery-scripting-with-nietzsche/) We’ve recently come across a complex delivery chain utilizing multiple script languages designed to deploy high-profile malware families such as the open-source-made DCRat or the Rhadamanthys infostealer. 09 January 2025 ### [SharpRhino: An old, new threat](https://www.acronis.com/en/tru/posts/sharprhino-an-old-new-threat/) SharpRhino is delivered as legitimate software and grants remote access to the victim's machine. Read our full analysis to see how attackers use it to propagate other malware. 08 January 2025 ### [TMPN (Skuld) Stealer: The dark side of open source](https://www.acronis.com/en/tru/posts/tmpn-skuld-stealer-the-dark-side-of-open-source/) Skuld, also known as TMPN Stealer, is an information-stealing malware written in Golang (Go) that emerged in May 2023. Read the full analysis of this open-source threat. [1](https://www.acronis.com/en/tru/categories/security-research/page/1/) [2](https://www.acronis.com/en/tru/categories/security-research/page/2/) [3](https://www.acronis.com/en/tru/categories/security-research/page/3/) [4](https://www.acronis.com/en/tru/categories/security-research/page/4/) [5](https://www.acronis.com/en/tru/categories/security-research/page/5/) [6](https://www.acronis.com/en/tru/categories/security-research/page/6/) [7](https://www.acronis.com/en/tru/categories/security-research/page/7/)...[15](https://www.acronis.com/en/tru/categories/security-research/page/15/)