Acronis releases first TRU Cyber Pulse 2026 threat report

Acronis has released the first edition of its TRU Cyber Pulse 2026 report, a publication from its Threat Research Unit that examines threat actor techniques, behaviors, and objectives. The report gives particular attention to managed service providers and the organizations they support. Its central message is that a compromised device or identity can provide access well beyond the initial point of entry, so understanding those connections is necessary for detection, containment, and recovery.

Security teams need to measure how far a compromised identity or system reaches, not only the original device. For MSPs, a single compromised account or management tool may place several client environments at risk. The report highlights visibility into identity and cloud activity, limits on AI agent permissions, monitoring for disabled defenses, and testing of recovery plans as useful practices.

The report covers emerging attack techniques, advanced persistent threats, espionage, and cybercrime, with research tied to practical guidance. In an investigation called BOSSAI, TRU found one operator using AI agents for reconnaissance, exploitation, and infrastructure management across targets in multiple countries. Stolen credentials, sessions, tokens, and API keys can carry an endpoint infection into cloud services, development environments, and other connected systems.

Ransomware operators and advanced threat groups disable endpoint protection and logging, creating blind spots as they move. AI-assisted attackers can develop and weaponize exploits within hours. Threat actors use GitHub and Telegram to host or direct malicious activity, which makes abuse harder to distinguish from legitimate use. Linux and VMware ESXi systems are increasingly targeted, exposing workloads and services that organizations depend on.

The report synthesizes investigations into significant cyber incidents, malware campaigns, and threat actors to outline the 2026 threat landscape and emerging trends. “The biggest trend we’ve noticed is how AI is helping capable operators coordinate more of the attack lifecycle,” said Santiago Pontiroli, Threat Intelligence Research Lead at Acronis.

“Organizations rely on interconnected identities, tools and services, and attackers know how to exploit those connections,” said Gerald Caron, CISO at Acronis. The report will be available for free download beginning Monday, November 9.