Acronis Cyber Protection Center

Cyberthreats and cybersecurity insights

Acronis Blog →

Covers information to help protect your data

Acronis Cyber Protection Center

Tips and tricks

Most recent on Tips and tricks

Select

14 Juli 2021 — 5 min read

Acronis

14 Juli 2021 — 5 min read

Acronis protects customer’s server in REvil attack on Kaseya

The recent supply-chain attack on Kaseya by the REvil ransomware group impacted dozens of managed service providers (MSPs) who rely on Kaseya VSA, as well as thousands of small businesses that are managed by those MSPs. While the initial ransom demand was dropped from $70 million to $50 million, the pain and frustration of those targeted rose steadily during the incident.

05 Juni 2021 — 3 min read

Acronis

05 Juni 2021 — 3 min read

JBS attack shows the immense threat posed by ransomware

The world’s largest meat supplier, JBS, was forced to halt operations at many of its U.S. and Australian processing plants after a massive cyberattack. This activity threatened supply chains across the world, and resulted in an immediate rise in wholesale red meat prices. This cyberattack, while notable in its own right, is also simply the latest example in a dangerous pattern of escalating ransomware hazards.

29 Mei 2021 — 2 min read

Acronis

29 Mei 2021 — 2 min read

SolarWinds hackers launch new attacks, warns Microsoft

The Microsoft Threat Intelligence Center (MSTIC) has uncovered a wide-scale spear phishing campaign driven by Nobelium — the threat actors behind the recent SolarWinds attacks and the SUNBURST backdoor used in those strikes. Nobelium continues its attacks on U.S. agencies and the private organizations in their sphere. The group managed to hijack an email distribution account used by the United States Agency for International Development (USAID), sending thousands of authentic-looking but malware-laden messages to a variety of human rights groups, think tanks, and other organizations.

10 Mei 2021 — 3 min read

Acronis

10 Mei 2021 — 3 min read

DarkSide ransomware attack on Colonial Pipeline cripples energy infrastructure

In the latest incident that illustrates the overlap of the traditional economy and infrastructure with the digital realities of modern business, one of the largest pipelines in the U.S. was forced to shut down this past weekend after being hit by a ransomware group. Managed by Colonial Pipeline Co., the 5,500-mile pipeline runs across 14 states between Houston, TX and New York Harbor, and provides around 45% of all fuel for the U.S. East Coast.

28 Januari 2021 — 4 min read

Acronis

28 Januari 2021 — 4 min read

OSAMiner: The Apple cryptojacker that hid for five years

While OSAMiner has been around since 2015, and known since at least 2018, a newly discovered version of OSAMiner has remained hidden from researchers by cleverly concealing one run-only AppleScript inside of another run-only AppleScript. Run-only scripts do not contain human-readablez code and are notoriously difficult to fully decompile. Some IoCs have been able to be identified in these campaigns but a full analysis was not previously available, leaving some of the critical files in these campaigns lurking in the dark. This has changed with a couple of recently developed tools to aid in decompiling AppleScripts. Using these tools, we can now get a better view at the internals of the files in this cryptojacking campaign, as well as a broader view of the files associated with the malware.

20 Januari 2021 — 3 min read

Acronis

20 Januari 2021 — 3 min read

Malwarebytes targeted by cyberattack group that hit SolarWinds

You don’t have to work in cybersecurity to be aware of the recent discovery that a sophisticated state actor had potentially compromised tens of thousands of private companies and government institutions in the Americas, Europe, and the Middle East. The means was a software supply-chain: attackers breached the software distribution infrastructure of tech vendor SolarWinds, embedding malware in its popular Orion network management tool. When customers downloaded the latest Orion product update, the malware surreptitiously spread throughout their organizations, in many cases finding and forwarding sensitive data to external servers controlled by the attackers. Now comes news that SolarWinds was not the only victim of this Advanced Persistent Threat (APT) attack. Cybersecurity vendor Malwarebytes disclosed earlier this week that it had also been victimized by the same threat actors.

23 Desember 2020 — 7 min read

Acronis

23 Desember 2020 — 7 min read

Defending against supply chain attacks like the SolarWinds breach

The success of the massive SolarWinds supply-chain attack presents an urgent new cybersecurity challenge to every business. We plumb the tactics used in the SolarWinds breach and show how Acronis defends against it and similar attacks.

15 Desember 2020 — 2 min read

Acronis

15 Desember 2020 — 2 min read

Acronis Security Advisory: SUNBURST breaches SolarWinds’ Orion software to launch supply-chain attack

Following reports that SolarWinds’ Orion business software was compromised and used in a supply-chain attack by SUNBURST malware. The distributed malware then used elevated credentials gained by compromising network traffic management systems to target FireEye, a cybersecurity firm, and several U.S. government agencies. Details of the attack are available from the Cybersecurity and Infrastructure Security Agency (CISA). While not affected by this event, Acronis wants to reassure partners and customers that we have a strict, secure software development life cycle (SDLC) in place, which we continuously strengthen, to ensure our solutions are safe, secure, and reliable.

29 Oktober 2020 — 4 min read

Acronis

29 Oktober 2020 — 4 min read

FBI warns of large-scale ransomware threat to the U.S. healthcare industry

The threat of a large-scale ransomware attack once again grabbed headlines in the mainstream press as the U.S.’s Federal Bureau of Investigations, Department of Homeland Security, and Department of Health and Human Services warned that cybercriminals were targeting American healthcare providers. The alert, which was issued Wednesday, warned that there was “credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers” focused on “data theft and disruption of healthcare services.” The warning comes as hospitals, medical facilities, and healthcare workers around the country are faced with spiking cases of COVID-19. The timing is no accident, as cybercriminals are leveraging the need for these healthcare providers to have access to their data and systems.