Company
Acronis is a cybersecurity and data protection vendor offering backup, disaster recovery and endpoint security; its Threat Research Unit tracks malware.
Acronis says a new backdoor pair is hitting Afghan telecom and South Asian critical infrastructure, with one implant running command and control through the Google Sheets API.
Reality
Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.
Reality
CVE-2026-76461 is one of three flaws confirmed under active attack in a single week. Revolut's customer records left by a different route, a request sent from an email address on a government agency's own domain.
Reality
The 7.8-rated privilege escalation in Acronis' cPanel and WHM backup plugin needs a local account on the server to work. The hosting providers and MSPs that run those servers are the only party who can install the fix.
Perspective Coverage
4 publishersReality
Acronis attributes exploitation of CVE-2026-60004 to a China-linked cluster that automated a published proof-of-concept from July 29, scanned 1,386 self-hosted Gitea servers and left a Linux rootkit behind.
Reality
Acronis counts 143 ransomware victims among MSPs, IT-service firms and telecoms in 2025, with phishing at 52% of initial access and unpatched software at 27%. Its own checklist puts the burden of proof on the tenant, not the platform.
Reality
Acronis says Pakistan's Transparent Tribe is running new Patchcord and Sheetcord implants against Afghan government and telecom targets, with no confirmed compromises in India.
Reality
Check Point says Microsoft's signed BTR.sys remediation driver can be repurposed as a kernel operation engine with no vulnerable driver needed. Signature-based blocking does not apply.
Reality