Acronis Threat Report Warns of Expanding Attack Surfaces
New research shows single operators using artificial intelligence to orchestrate multi-country breaches while targeting shared provider systems.
- By Jesse Jacobs
- Nov 10, 2026
Cybersecurity researchers warned that modern threat actors are increasingly using artificial intelligence to amplify operational scale while exploiting trusted management services to compromise broader enterprise networks.
According to the inaugural TRU Cyber Pulse report from the Acronis Threat Research Unit, attackers are using automated agents to compress the timeline between vulnerability disclosure and exploit development into just hours. In one case documented by researchers, an investigation dubbed BOSSAI revealed a solitary operator deploying AI agents across reconnaissance, exploitation and infrastructure management to hit multiple targets internationally.
The findings indicate that perimeter defenses alone are insufficient against evolving lateral movement techniques. Attackers frequently deploy infostealers to obtain access credentials, tokens and Application Programming Interface keys, turning a localized endpoint breach into widespread access across cloud platforms and development repositories. Threat actors are also abusing mainstream third-party services like GitHub and Telegram to host malicious command-and-control operations, masking their traffic among normal enterprise activities.
For managed service providers and IT vendors, the risks are heightened. Because MSPs use administrative identities, shared tools and centralized platforms to support numerous clients, a single breach within the provider's toolset can expose multiple downstream client networks simultaneously. The research also highlighted that ransomware groups are deliberately disabling security logging on host machines to blind security teams while prioritizing core hypervisor and server targets, particularly Linux and VMware ESXi environments.
Security teams must look past the initial infected device and trace the entire footprint of compromised credentials across linked systems, according to Acronis threat intelligence researchers. Maintaining continuous visibility across the entire attack lifecycle remains critical for effective threat containment, especially as automated tools allow solo operators to execute complex, multi-stage intrusions.