Acronis has carried out its first Acronis TRU Cyber Pulse 2026, a report prepared by the Acronis Threat Research Unit (TRU) that analyzes the techniques, behaviors and objectives of the threat actors that are shaping the current landscape of cybersecurity and data protection.
This first edition discusses emerging attack techniques, advanced persistent threats (APT), espionage activities, and cybercrime. The report links research findings to practical recommendations, paying particular attention to managed service providers (MSPs) and the organizations they support.
Their key takeaway is that a compromised device or identity can provide access far beyond the initial entry point, making understanding those connections essential to detecting, containing, and recovering from attacks.
Main conclusions of the Acronis study
- AI can help a single attacker coordinate sophisticated operations. In its BOSSAI investigation, TRU found that a single operator used AI agents to perform reconnaissance, exploitation and infrastructure management tasks while attacking targets in multiple countries.
- Infostealers put connected identities and services at risk. Stolen credentials, sessions, tokens, and API keys can cause an infection initially limited to one endpoint to spread to cloud services, development environments, and other connected systems.
- Attackers are deliberately disabling security controls. Ransomware operators and advanced threat groups use techniques to neutralize defenses and disrupt the protection of endpoints and systems of record, creating blind spots as they move through compromised environments.
- The time available to respond to newly disclosed vulnerabilities is decreasing. Attackers using AI can develop and turn exploits into attack tools in a matter of hours, increasing the urgency of assessing and patching exposed systems.
- Trusted services can become part of the attack infrastructure. Threat actors use well-known platforms such as GitHub and Telegram to host or direct malicious activity, making it difficult to distinguish fraudulent uses from legitimate ones.
- Ransomware is increasingly penetrating enterprise infrastructure. Linux and VMware ESXi systems are increasingly being targeted, exposing workloads and services that organizations depend on.
- A security breach can have a major impact on MSPs and their clients. Administrative identities, remote management tools, and shared infrastructures can connect multiple customer environments.
Maintain visibility over identities
The Acronis TRU Cyber Pulse 2026 report highlights why security teams must investigate the scope of a compromised identity or system, not just the device from which the attack originated. For MSPs, a single compromised account or management tool can put multiple customer environments at risk. The findings also highlight the importance of maintaining visibility into identities and cloud activity, limiting AI agent permissions, monitoring disabling defenses, and testing recovery plans.
“The first Cyber Pulse report reflects the breadth of work developed by TRU throughout the year, from analyzing malware and campaigns to tracking how threat actors adapt their operations,” says Santiago Pontiroli, Threat Intelligence Research Lead at Acronis. “Analyzing these investigations together can identify patterns that may be more difficult to detect in an isolated incident. The main trend we have seen is how AI is helping experienced operators coordinate more phases of the attack cycle, while stolen identities and trusted tools facilitate their movements through connected environments. Defense teams must address these risks together, from first alert to containment and recovery.”
As the Acronis Threat Research Unit (TRU) has expanded its research activity, the team has regularly published findings that have sparked interest from the international cybersecurity community, other research teams, and media outlets around the world. By publicly sharing its findings, TRU contributes to the security industry by providing insights into emerging threats and enabling intelligence sharing to help security managers, IT teams and MSPs understand the threats that may impact their environments. Additionally, TRU provides other researchers and practitioners with information that they can use as a basis for their own investigations and advocacy strategies.
MDR capabilities and recovery plans
The first TRU Cyber Pulse report brings together research results on relevant cybersecurity incidents, malware campaigns and threat actors to provide a comprehensive view of the 2026 threat landscape and emerging trends. Analyzed together, these investigations allow us to identify broader patterns and understand their implications for organizations.
IT teams need visibility into activity related to identities, cloud services, and remote management tools
“Organizations depend on interconnected identities, tools and services, and attackers know how to exploit those connections,” said Gerald Caron, CISO at Acronis. “This report reinforces the idea that protecting endpoints alone is no longer enough. IT teams need visibility into activity related to identities, cloud services and remote management tools, as well as MDR capabilities and recovery plans that take into account the potential breach of administrative access. An AI-native platform that unifies protection, management and automation can give companies a clearer view of their environments, strengthen access controls and facilitate a faster, more coordinated response, helping MSPs and their clients to contain incidents and recover with confidence.”
