Acronis’s Threat Research Unit (TRU) has pulled a year of investigations into a single report, and its main warning is about reach: a compromised device or identity can open doors far beyond the machine where an attack began.

The company has published the first edition of the Acronis TRU Cyber Pulse 2026, covering attack techniques, advanced persistent threats (APTs), espionage activity and cybercrime. It draws on the unit’s research across malware, campaigns and threat actors, and ties the findings to guidance for managed service providers (MSPs) and the organisations they serve.

Acronis lists seven findings.

• AI lets one operator do more. In its BOSSAI investigation, TRU found a single operator using AI agents for reconnaissance, exploitation and infrastructure management across targets in several countries. GyanMuse reported on that case earlier this month.
• Infostealers extend the damage. Stolen credentials, session tokens and API keys can carry an infection from one endpoint into cloud services, development environments and other connected systems.
• Defences are being switched off. Ransomware operators and advanced groups use “defense impairment” techniques to disrupt endpoint protection and logging, leaving blind spots as they move through a network.
• Patch windows are shrinking. AI-assisted attackers can build and weaponise exploits for newly disclosed vulnerabilities within hours, Acronis says, making fast assessment and patching more urgent.
• Trusted services are used as cover. Attackers host or direct malicious activity through familiar platforms such as GitHub and Telegram, making abuse harder to tell from normal use.
• Ransomware is going deeper. Linux and VMware ESXi systems are increasingly targeted, exposing the workloads and services that businesses rely on.
• MSPs carry concentrated risk. Administrative identities, remote management tools and shared infrastructure can link several customer environments, so one compromised account or tool may expose many clients.

Santiago Pontiroli, Threat Intelligence Research Lead at Acronis, said: “The biggest trend we’ve noticed is how AI is helping capable operators coordinate more of the attack lifecycle, while stolen identities and trusted tools can help them move through connected environments. Defenders need to consider those risks together, from the first alert through containment and recovery.”

Gerald Caron, Acronis’s chief information security officer, said: “Organizations rely on interconnected identities, tools and services, and attackers know how to exploit those connections. This report reinforces that protecting individual endpoints alone is not enough. IT teams need visibility across identity, cloud, and remote management activity, along with MDR capabilities and recovery plans that account for compromised administrative access.”

The practical advice is to investigate the reach of any compromised system or identity and not only the original device, keep visibility into identity and cloud activity, limit the permissions given to AI agents, watch for disabled defences and test recovery plans.