Acronis Blog

Acronis Blog
Malware protection

All stories in Malware protection

March 31, 2025  — 3 min read
Acronis
March 31, 2025  — 3 min read
Acronis Cyber Protect Cloud earns Top Product award again in latest AV-TEST evaluation
In the AV-TEST Institute’s January–February 2025 evaluation, Acronis Cyber Protect Cloud delivered a flawless performance again, demonstrating constant and reassuring results.
November 30, 2021  — 9 min read
Acronis
November 30, 2021  — 9 min read
VenomRAT: A remote access tool with dangerous consequences
The first messages about VenomRAT started to appear in June 2020. By analyzing the code, analysts concluded that this new threat is a modified fork of Quasar RAT. The malware itself was introduced on malware-oriented forums, in posts advertising it as an effective tool to remotely access computers for $150 per month.
November 26, 2021  — 14 min read
Acronis
November 26, 2021  — 14 min read
Trojan-as-a-service: From Formbook to XLoader
Discovered in 2016, Formbook appeared on underground forums, advertised as an infostealer for Windows. In October 2020, Formbook was renamed XLoader; as its developers say, it has the same features, but has improved from the previous version. XLoader can steal users’ information from various browsers, email clients and messengers, and is available to cybercriminals as a service.
October 19, 2021  — 4 min read
Acronis
October 19, 2021  — 4 min read
Acronis Cyber Readiness Report 2021 reveals critical security gaps left by IT leaders
The Acronis Cyber Readiness Report 2021 analyzes how businesses and the IT industry have adapted to the post-COVID landscape. Many are still struggling in a world that shows no sign of a full return to office-only environments – and while demand for cyber protection solutions continues to grow, misplaced trust, misaligned priorities, and an ever-evolving cyberthreat landscape are threatening businesses.
October 04, 2021  — 3 min read
Acronis
October 04, 2021  — 3 min read
How to stay proactively protected this Cybersecurity Awareness Month
This month marks both the eighteenth year of National Cybersecurity Awareness Month — an initiative led by the U.S. Department of Homeland Security — and the tenth year of European Cybersecurity month, the European Union’s annual campaign around promoting digital security and staying safe online. Today, we take a look at the current cyberthreat landscape and proactive steps you can take towards data safety.
August 26, 2021  — 3 min read
Acronis
August 26, 2021  — 3 min read
DCIG: Acronis offers MSPs clear advantages over StorageCraft
Choosing the right solution to build your services around can feel like a tricky prospect. Analyst firm Data Center Intelligence Group (DCIG) recently compared Acronis Cyber Protect Cloud and StorageCraft Cloud Services — and we encourage service providers to consider their findings.
July 28, 2021  — 5 min read
Acronis
July 28, 2021  — 5 min read
#BHUSA or bust: Hopes and expectations for Black Hat 2021
Since 1997, Black Hat has been a staple in the world of cybersecurity conferences. Having been in cybersecurity for nearly a decade, I’ve been aware of Black Hat, but haven’t had the opportunity to attend. Sure, I’ve attended DEF CON and some local cybersecurity conferences, but never one with a corporate focus.
July 05, 2021  — 7 min read
Acronis
July 05, 2021  — 7 min read
REvil ransomware supply chain attack against MSPs
Just as people were starting to forget about the huge Solar Winds software supply-chain attack, another high-profile attack happens. This time, the REvil/Sodinokibi ransomware group pushed out a malicious update for Kaseya's VSA IT management software, leading to dozens of MSPs around the globe – and subsequently their customers – being compromised by ransomware. The global network of Acronis Cyber Protection Operation Centers (CPOCs) is monitoring the situation, as additional details of the attack are still unraveling. Here’s what we know at this point.
July 04, 2021  — 2 min read
Acronis
July 04, 2021  — 2 min read
Cyberattack group REvil attacks MSPs and their clients in a supply-side attack
Managed service providers (MSPs) are on alert this holiday weekend as those that run Kaseya VSA software are being informed by the company to shut down their on-premises VSA servers following a suspected supply-chain attack on their remote management software. Kaseya proactively shut down their SaaS servers that run VSA for their partners.
June 04, 2021  — 5 min read
Acronis
June 04, 2021  — 5 min read
Threat analysis: DoppelPaymer ransomware
DoppelPaymer is a successor of BitPaymer ransomware, and is part of the Dridex malware family. It’s currently being distributed in various forms, including phishing or spam emails with attached documents that are embedded with malicious code — either JavaScript or VBScript. On execution, this code downloads DoppelPaymer’s first-stage loader on the victim’s machine. The attackers then use the PowerShell Empire toolkit to run a brute-force attack on Active Directory. The Mimikatz module is used to dump passwords from the system memory.
June 04, 2021  — 5 min read
Acronis
June 04, 2021  — 5 min read
Threat analysis: Pysa (Mespinoza) ransomware
Pysa takes an approach commonly referred to as “big game hunting,” meaning that the ransomware group targets high-value assets in organizations that are particularly sensitive to data loss or system downtime. The idea is that victims — which may include healthcare providers, government agencies, and managed service providers — are more likely to quickly pay the ransom, regardless of its cost.
June 04, 2021  — 8 min read
Acronis
June 04, 2021  — 8 min read
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager
Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager before encryption.
June 04, 2021  — 8 min read
Acronis
June 04, 2021  — 8 min read
Sekhmet ransomware Analysis
Sekhmet ransomware, which first appeared in March 2020, has already disclosed the stolen data from at least six victims to date. One recent known attack that occurred on 20 June 2020 targeted SilPac, a gas handling solutions company based in Santa Clara, California.