Acronis connects agent permissions and stolen identities in new cyberattack assessment
Swiss cybersecurity company Acronis has released its first TRU Cyber Pulse assessment, combining investigations conducted throughout the year. It examines how AI tools, compromised identities and attacks on recovery infrastructure can extend cyber operations across connected environments. Findings include malicious agent extensions and overlapping remote-access tools, with recommendations addressing permissions, stolen sessions and recovery systems alongside infected devices.
Artificial Intelligence··Midday
Year-round investigations become a combined assessment
Swiss cybersecurity company Acronis released its first TRU Cyber Pulse assessment on November 9. The publication combines work by its Threat Research Unit, the team examining malware and attack campaigns, with incident-response investigations. It covers AI-augmented operations, compromised identities and attacks affecting recovery infrastructure, including risks when shared systems give attackers access across connected environments.[1], [2]
The material is organized around emerging attack techniques, persistent threats and espionage, and cybercrime. The underlying investigations took place throughout the year; the November 9 publication brings them together in a first combined assessment. Acronis examines interference with security controls alongside initial access and recovery, following operations that can reach beyond the first infected computer into other services.[1]
Agent extensions combine instructions with executable code
In the BOSSAI investigation, Acronis describes one technically capable operator linking more than ten AI models to reconnaissance, scanning and exploitation tools. The setup supported simultaneous activity against targets in several countries. BOSSAI is the company’s name for that investigation into connected attack operations.[1]
The company says it identified more than 575 malicious skills for the OpenClaw agent system across 13 developer accounts. Presented as legitimate utilities, these add-ons can deliver trojans, cryptocurrency miners and information stealers. Skills join instructions with executable code and operate under permissions already granted to the agent. Acronis therefore recommends enforcing permission controls outside the model itself.[1]
Stolen sessions and remote access extend an intrusion
Among more than 1.8 million endpoints already running Acronis remote-management software, 63.1 per cent had another remote-management or remote-access tool. That population consists of devices using the company’s software. Some extra tools serve legitimate support needs, while old agents and accounts left after a provider change can preserve routes into a system.[1]
Stolen browser sessions, cloud credentials and application programming interface keys can carry access into connected services. Acronis recommends revoking sessions and reviewing later account activity alongside device cleanup. It also describes attacks on Linux and ESXi virtualization systems that stop virtual machines and delete recovery snapshots. Its recovery recommendations include testing restoration when ordinary administrative systems cannot be trusted.[1]
