--- title: Acronis Cyberthreats Update, May 2024 description: The number of malicious URLs detected increased 24%, while malware attacks increased 6%. Read the full report to learn more about cyberthreat activity in April 2024. canonical_url: https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-may-2024/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 14 May 2024 # Acronis Cyberthreats Update, May 2024 The Acronis Cyberthreats Update reveals threat activity and trends during April 2024. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** **Authors:** **Irina Artioli****—**Cyber Protection Evangelist **Candid W****ü****est****—**VP of Product Management _The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis analysts and sensors. Figures presented here were gathered in April of this year and reflect threats that we detected as well as news stories from the public domain. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world._ Over 11.5 million malicious URLs were blocked at the endpoint by Acronis in April 2024— a 24% increase compared to March 2024. Other key findings include: ![Image 1: Acronis Cyberthreats Update, May 2024](https://staticfiles.acronis.com/images/content/e8ffd0a40783ead64cc03c4664369f35.png) ## Incidents of the month A recent analysis unveiled a [severe security risk for Linux distributions](https://thehackernews.com/2024/04/malicious-code-in-xz-utils-for-linux.html) with a backdoor discovered in the widely used XZ Utils open-source library, tracked as CVE-2024-3094 and rated 10 out of 10 on the CVSS scale. The backdoor, allowing remote code execution and potentially granting complete system access, was intentionally inserted by project maintainer Jia Tan (aka JiaT75) through a sophisticated social engineering campaign spanning two years. Despite the breach being caught early, it highlights vulnerabilities in the open-source supply chain and prompts reflection on reliance and risk management, as the backdoor could have provided unauthorized access to numerous systems through the OpenSSH server process. Additionally, [CrushFTP has issued urgent warnings](https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/) to users regarding an actively exploited zero-day vulnerability, urging immediate patching of servers. The vulnerability, allowing unauthenticated attackers to escape the user's virtual file system and access system files, poses a serious threat. While those employing a DMZ perimeter network are safeguarded, users are advised to promptly upgrade to CrushFTP versions 10.7.1 or 11.1.0 to mitigate the risk. ![Image 2: Acronis Cyberthreats Update, May 2024](https://staticfiles.acronis.com/images/content/03c5d5e7a43f667a9bafd3f1266c1dd3.png) The following table shows the normalized percentage of clients with at least one ransomware detection in the given month. The higher the number, the higher the risk of a workload in that country being attacked by ransomware. Among the top three countries by normalized ransomware detections in April, South Korea ranks first, followed by the Philippines and China. ![Image 3: Acronis Cyberthreats Update, May 2024](https://staticfiles.acronis.com/images/content/6a1b390d61ca1f8b2f5755fc7d1fb01d.png) And of 15 countries analyzed for normalized ransomware detections, the Netherlands saw the highest number of detections. ![Image 4: Acronis Cyberthreats Update, May 2024](https://staticfiles.acronis.com/images/content/209a551a85f0d1250f3d34e6378d2752.png) ## Protection The aforementioned threats can be detected and mitigated with solutions from Acronis. [Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud)](https://www.acronis.com/en-us/products/cloud/cyber-protect/) protects against both known and never-before-seen threats through a multilayered protection approach. This includes behavior-based detection, AI/ML-trained detections and anti-ransomware heuristics, which can detect and block encryption attempts and roll back any tampered files automatically without any user interaction. Additional advanced email security and URL filtering can help you protect against social engineering threats. And _Acronis_#CyberFit score helps you quickly identify systems that need attention, while the integrated Patch Management makes updating your software to the latest versions simple. [Advanced Security + Endpoint Detection and Response (EDR)](https://www.acronis.com/en-us/products/cloud/cyber-protect/security-edr/) for Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) brings the visibility needed to understand attacks while simplifying the context for administrators and enabling efficient remediation of any threats. Learn more about [Acronis’ approach to cyber protection](https://www.acronis.com/en-us/cyber-protection/). Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)