SCHAFFHAUSEN, Switzerland, Nov. 09, 2026 (GLOBE NEWSWIRE) -- Acronis, a global provider of an AI-native cyber platform for MSPs and IT departments, today announced the release of the inaugural Acronis TRU Cyber Pulse 2026, a report from the Acronis Threat Research Unit (TRU) examining threat actor techniques, behaviors, and objectives shaping today’s cybersecurity and data protection landscape.
The first edition examines emerging attack techniques, advanced persistent threats (APTs), espionage activity, and cybercrime. It connects research findings to practical guidance, with particular attention to managed service providers (MSPs) and the organizations they support. The report’s central message is that a compromised device or identity can provide access well beyond the initial point of entry, and that understanding those connections is essential to detecting, containing, and recovering from attacks.
Key findings include:
AI can help a single operator coordinate sophisticated operations. In its BOSSAI investigation, TRU found that one operator used AI agents for reconnaissance, exploitation, and infrastructure management while pursuing targets across multiple countries.
Infostealers put identities and connected services at risk. Stolen credentials, sessions, tokens and API keys can extend an endpoint infection into cloud services, development environments and other connected systems.
Attackers are deliberately disabling security controls. Ransomware operators and advanced threat groups use defense impairment techniques to disrupt endpoint protection and logging, creating blind spots as they move through an environment.
The time to respond to newly disclosed vulnerabilities is shrinking. AI-assisted attackers can develop and weaponize exploits in a matter of hours, increasing the urgency of assessing and patching exposed systems.
Trusted services can become part of attack infrastructure. Threat actors use familiar platforms such as GitHub and Telegram to host or direct malicious activity, making it harder to distinguish abuse from legitimate use.
Ransomware is reaching deeper into enterprise infrastructure. Linux and VMware ESXi systems are increasingly targeted, exposing workloads and services that organizations depend on.
A compromise can have an expanded impact on MSPs and their clients. Administrative identities, remote management tools and shared infrastructure can connect multiple customer environments.
The Acronis TRU Cyber Pulse 2026 report underscores why security teams need to investigate the reach of a compromised identity or system, not only the original device. For MSPs, a single compromised account or management tool may put multiple client environments at risk. The findings also highlight the value of maintaining visibility into identity and cloud activity, limiting the permissions of AI agents, monitoring for disabled defenses, and testing recovery plans.
“The inaugural Cyber Pulse report reflects the breadth of TRU’s work throughout the year, from analyzing malware and campaigns to tracking how threat actors adapt their operations,” said Santiago Pontiroli, Threat Intelligence Research Lead at Acronis. “Looking across those investigations helps reveal patterns that can be harder to see in any single incident. The biggest trend we’ve noticed is how AI is helping capable operators coordinate more of the attack lifecycle, while stolen identities and trusted tools can help them move through connected environments. Defenders need to consider those risks together, from the first alert through containment and recovery.”
As the Acronis TRU has expanded its research, the team regularly publishes findings that have drawn attention from the global cybersecurity community, other research teams, and media worldwide. By sharing its findings publicly, TRU contributes to the security industry by sharing insights around emerging threats and supports the exchange of intelligence to help security leaders, IT teams, and MSPs understand threats that may affect their environments. TRU also arms researcher and practitioner peers with insights to build on in their own research and defensive work.
The inaugural TRU Cyber Pulse report synthesizes findings from investigations into significant cyber incidents, malware campaigns, and threat actors to provide a comprehensive overview of the 2026 threat landscape and emerging trends. Viewed collectively, these investigations reveal broader patterns and their implications for organizations.
“Organizations rely on interconnected identities, tools and services, and attackers know how to exploit those connections,” said Gerald Caron, CISO at Acronis. “This report reinforces that protecting individual endpoints alone is not enough. IT teams need visibility across identity, cloud, and remote management activity, along with MDR capabilities and recovery plans that account for compromised administrative access. An AI-native platform that unifies protection, management, and automation can give businesses a clearer view across their environments, strengthen access controls, and support a faster, more coordinated response that helps MSPs and their clients contain incidents and recover with confidence.”
About Acronis:Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. For more information, visit www.acronis.com.
