TRU Security

Updates from Acronis Threat Research Unit

Acronis
Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix
Acronis TRU researchers have discovered an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of “Critical Windows Security Updates” to trick victims into executing malicious commands.
Insights
November 18, 2025 — 3 min read
Acronis
Acronis Cyberthreats Update, November 2025
The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis...
November 10, 2025 — 22 min read
Acronis TRU Alliance {VirusTotal}: Tracking FileFix, Shadow Vector, and SideWinder
Introducing the Acronis TRU Alliance Series. This new series highlights collaborative research...
November 07, 2025 — 2 min read
MSP cybersecurity news digest, November 3, 2025
Qilin ransomware abuses Windows Subsystem for Linux to deploy Linux encryptors on Windows, Atroposia...
November 04, 2025 — 4 min read
MSP cybersecurity news digest, October 21, 2025
Here is the MSP cybersecurity news digest for October 21, 2025 from the Acronis Threat Research Unit...
October 28, 2025 — 3 min read
MSP cybersecurity news digest, October 28, 2025
Urgent WSUS RCE flaw actively exploited! Plus: Fake LastPass inheritance emails steal vaults, Iran's...
October 17, 2025 — 3 min read
Acronis Cyberthreats Update, October 2025
The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis...
September 29, 2025 — 5 min read
MSP cybersecurity news digest, September 29, 2025
Here is the Acronis Threat Research Unit (TRU) MSP cybersecurity news digest, September 29, 2025
September 23, 2025 — 6 min read
MSP cybersecurity news digest, September 23, 2025
Here is the weekly digest with news from Acronis TRU for the week of September 23, 2025
September 11, 2025 — 3 min read
Acronis Cyberthreats Update, September 2025
The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis...

Trends and analysis

March 06, 2023 — 15 min read
Acronis
IcedID (BokBot): From banking trojan to backdoor
IcedID, also known as BokBot, was initially a banking trojan when it was discovered in 2017. Now it is...
February 13, 2023 — 7 min read
Acronis
CaddyWiper makes Windows machines unusable
CaddyWiper is an example of data-wiping malware, whose purpose is to corrupt the operating system and...
February 06, 2023 — 8 min read
Acronis
DoubleZero: A data wiper deployed against Ukraine
The DoubleZero wiper — so named for its tactic of zeroing files — was first discovered on March 17,...
February 02, 2023 — 8 min read
Acronis
Vawtrak: A banking trojan with a long history
Vawtrak is a banking trojan — a form of malware that attempts to steal credentials from banks. It...
January 05, 2023 — 9 min read
Acronis
Royal ransomware’s actors make high demands
Royal ransomware was first spotted in January 2022, targeting different corporations. This group does...
December 27, 2022 — 2 min read
Acronis
AV-Comparatives: Acronis Cyber Protect certified an...
Acronis Cyber Protect with the Advanced Security pack successfully passed the rigorous test criteria...