--- title: Browse articles in Security Research description: Get the latest cybersecurity updates and threat intelligence from Acronis Research Unit. Learn about the latest emerging cyberthreats and protection strategies. canonical_url: https://www.acronis.com/en/tru/categories/security-research/page/5/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * Security Research # Browse articles in Security Research 10 January 2024 ### [CustomLoader: A malicious link](https://www.acronis.com/en/tru/posts/customloader-a-malicious-link/) CustomerLoader was first spotted in June 2023, delivering different payloads to its targets. It is a .NET loader, so named from the ‘custom’ string in its C&C communication. In this campaign, it used a .LNK file to bring the DuckTail infostealer to victims' machines. DuckTail is a Vietnamese threat group that became active in May 2023. Using phishing job listings on LinkedIn, DuckTail delivers malicious files to victims. 21 December 2023 ### [Transforming incident management with the power of AI](https://www.acronis.com/en/tru/posts/transforming-incident-management-the-power-of-ai-in-acronis-cyber-protect-cloud-advanced-security-edr/) With cyberthreats becoming more sophisticated, Acronis Cyber Platform stands out as a robust solution that not only safeguards your data and systems but also revolutionizes incident management through the integration of cutting-edge artificial intelligence (AI) technology. And, as you may know, Acronis recently released Cyber Platform Advanced Security + EDR, to extend the core product's functionality. 16 November 2023 ### [DarkGate relies on malicious AutoIt scripts](https://www.acronis.com/en/tru/posts/darkgate-relies-on-malicious-autoit-scripts/) DarkGate was first spotted in 2018. New attacks have used Skype messages with malicious VBA attachments. The main purpose of this script is to download and execute the AutoIt script, which has been observed in DarkGate campaigns since 2020. A user with the name ‘RastaFarEye’ advertised his malware on underground Russian language forums, and it now has numerous capabilities. 15 November 2023 ### [Ransomware diaries, part 1: QazLocker -Cyb3rK1dZ has more time than skills](https://www.acronis.com/en/tru/posts/ransomware-diaries-part-1-qazlocker-cyb3rk1dz-has-more-time-than-skills/) This article is the first in the ransomware diaries series. We will provide an in-depth look at some active ransomware families, such as Mallox or encryptors from the Epsilon Gang, revealing the unique picture they occasionally paint, along with commonalities they maintain along the way. Every family will represent a different piece of the current ransomware landscape to showcase how diversified it has become over the years. 02 November 2023 ### [AV-Test results: Acronis Cyber Platform scores 10/10 in Advanced Threat Protection](https://www.acronis.com/en/tru/posts/av-test-results-acronis-cyber-protect-cloud-scores-10-10-in-advanced-threat-protection/) AV-Test unveiled their Advanced Threat Protection test results for 10 real-life scenarios they ran in July and August 2023 in Windows 10 Professional. Once again, Acronis Cyber Platform with Advanced Security received the best possible score, successfully detecting and blocking all 10 attacks in their early stages. 30 October 2023 ### [Knight: An analysis of Cyclops’ ransomware successor](https://www.acronis.com/en/tru/posts/knight-an-analysis-of-cyclops-ransomware-successor/) At the end of July 2023, the Cyclops ransomware group announced on underground forums that the 2.0 version of their ransomware was renamed “Knight.” The Knight ransomware group began its ransomware-as-a-service operations in May 2023, targeting Windows, Linux and MacOS operating systems, encrypting files using Curve25519, HC-256 and ChaCha20 algorithms. 26 October 2023 ### [Acronis Cyber Protect gets perfect score in AV-Test evaluation of security products for macOS](https://www.acronis.com/en/tru/posts/acronis-cyber-protect-achieves-a-perfect-score-in-the-av-test-evaluation-of-security-products-for-macos/) Acronis Cyber Protect is a long-time participant in the AV-Test independent evaluation of security products for Apple’s macOS. It is critical that a cybersecurity product is consistent with good results, as new threats emerge. We are proud to report that Cyber Protect has achieved a perfect 6 out of 6 score in each and every test performed in the last year. 26 October 2023 ### [Acronis Cyber Platform once again excels in AV-Test Advanced Protection evaluation](https://www.acronis.com/en/tru/posts/acronis-cyber-protect-once-again-excels-in-av-test-advanced-protection-evaluation/) In an evaluation performed in May–June by well-known German testing laboratory AV-Test, Acronis Cyber Platform with Advanced Security achieved a perfect score. Acronis Cyber Platform blocked 10 out of 10 advanced threats crafted by laboratory experts to test the ability of security products to manage with new and unknown threats. 25 October 2023 ### [Ursnif, the banking trojan](https://www.acronis.com/en/tru/posts/ursnif-the-banking-trojan/) Ursnif, also known as Gozi or Dreambot, is a banking trojan. Ursnif is typically delivered via phishing emails that contain malicious attachments or links. There has been a surge of Ursnif campaigns led by different individuals with no relation to one another. These campaigns resulted in successful attacks on several Italian banks, stealing user credentials and gathering information from compromised networks. 17 October 2023 ### [Nokoyawa ransomware takes evasive action, leaves bilingual ransom notes](https://www.acronis.com/en/tru/posts/nokoyawa-ransomware-takes-evasive-action-leaves-bilingual-ransom-notes/) Nokoyawa ransomware was first discovered in February 2022, and it initially shared similarities to the Hive ransomware. As this threat has evolved, it's become more dangerous, and appears to have claimed numerous victims already. 02 October 2023 ### [BlackByte 3.0 uses vulnerable drivers to compromise systems](https://www.acronis.com/en/tru/posts/blackbyte-30-uses-vulnerable-drivers-to-compromise-systems/) BlackByte is an example of ‘ransomware-as-a-service‘ (RaaS), and the threat actors behind it constantly upgrade their malware to keep customers satisfied. Recent changes have increased the complexity of cybersecurity analytics, while also introducing new anti-analysis and anti-debugging techniques. 08 August 2023 ### [Acronis Cyberthreats Report, August 2023](https://www.acronis.com/en/tru/posts/acronis-cyberthreat-reports-august-2023/) The Acronis Cyberthreats Report covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here — including malware, URL and ransomware statistics — were gathered in July of this year and reflect threats that we detected as well as news stories from the public domain. [1](https://www.acronis.com/en/tru/categories/security-research/page/1/) [2](https://www.acronis.com/en/tru/categories/security-research/page/2/) [3](https://www.acronis.com/en/tru/categories/security-research/page/3/) [4](https://www.acronis.com/en/tru/categories/security-research/page/4/) [5](https://www.acronis.com/en/tru/categories/security-research/page/5/) [6](https://www.acronis.com/en/tru/categories/security-research/page/6/) [7](https://www.acronis.com/en/tru/categories/security-research/page/7/)...[15](https://www.acronis.com/en/tru/categories/security-research/page/15/)