Browse articles in Security Research

Users who have not properly configured Microsoft Exchange are exposed to email spoofing, which could lead to email compromise, data breaches and more.

In today’s rapidly evolving digital landscape, regularly scanning a company’s external perimeter for vulnerabilities іs not only a proactive measure, but also an essential defense strategy.

Zola ransomware is the latest addition to the Proton ransomware family. Acronis researchers break down the evolution of a Zola attack, from execution to encryption.

Eldorado ransomware has been active from at least March 2024. It mostly targets U.S. companies, including health care, education and government sectors.

Hunters International ransomware was first spotted in October 2023. While it shares many similarities with Hive ransomware, it is not a rebrand. But like Hive, Hunters International works as ransomware as a service (RaaS) and besides encryption, it also exfiltrates victim data.

In our daily work, we are constantly facing various attacks that can be directed at different organizations. One of these cases was the reason for an in-depth study of LNK files.

Detected at the end of 2024, Frea ransomware is a new variant in the Chaos ransomware family. Our latest malware analysis explores Frea in depth, with technical details on the execution and the encryption and post-encryption process.

From cybersecurity and backup to ticketing and billing, MSPs find themselves cobbling together tools and juggling multiple siloed consoles.

Trigona ransomware was first observed in June 2022. It has Windows and Linux versions and operates as ransomware as a service.

As of February 19, 2024, ConnectWise has disclosed two critical vulnerabilities within their ScreenConnect remote access software, highlighting the urgent need for users to update their systems to ensure security.

For more than a year, Acronis Cyber Platform with Advanced Security has achieved a perfect score in every AV-Test regular certification under macOS. The solution's real-time protection mechanisms, coupled with advanced threat detection algorithms, earned it a perfect score in December’s evaluation, where it detected 100% of 1,298 samples of widespread and prevalent malware chosen by AV-Test.

CustomerLoader was first spotted in June 2023, delivering different payloads to its targets. It is a .NET loader, so named from the ‘custom’ string in its C&C communication. In this campaign, it used a .LNK file to bring the DuckTail infostealer to victims' machines. DuckTail is a Vietnamese threat group that became active in May 2023. Using phishing job listings on LinkedIn, DuckTail delivers malicious files to victims.