Ransomware Crews Switch Off Security Tools Before They Encrypt, Acronis Finds

Estimated reading time: 9 minutes

Attackers increasingly stop endpoint agents, tamper with logging, and delete backups before they deploy ransomware. MITRE made that its own attack tactic in April. All three systems sit on broker Marsh’s list of 12 key cyber controls.

Acronis released its first TRU Cyber Pulse report on Nov. 9. Its Threat Research Unit (TRU) drew on a year of its own investigations. The report also cites research from Cisco Talos, ESET, Microsoft, Mandiant and others. Acronis sells backup, remote management and endpoint security to managed service providers (MSPs) and IT departments.

The report’s central warning concerns reach. A compromised device or identity can open access well beyond the first point of entry, Acronis says. Increasingly, attackers also go after the tools built to catch them, the report finds.

EDR Killers Become A Named Attack Tactic

MITRE added Defense Impairment to its ATT&CK framework in April 2026. The tactic covers deliberate interference with security tools. Attackers stop endpoint agents, disrupt logging, or cut an agent’s link to its monitoring service. The aim is less visibility for defenders and less time to respond, the report says.

Acronis analyzed a Windows sample of Qilin ransomware. It can terminate processes and services. It also deletes Volume Shadow Copies, the Windows restore points, before encryption. Acronis notes that not every Qilin affiliate follows the same sequence. Cisco Talos separately analyzed a Qilin EDR killer that uses drivers to terminate security processes.

The Gentlemen ransomware operation goes further. ESET found its operators maintain an EDR-killer suite for affiliates, with at least eight variants. Affiliates can draw on several ways to disable security products without building any of them, Acronis notes.

Backup deletion often appears in the same attack, the report says. One step blinds detection. The other makes the damage harder to reverse.

Defense Impairment And The Controls Insurers Expect

Endpoint detection and response (EDR), secured backups and logging all appear on Marsh’s list of 12 key cyber controls. Marsh calls certain controls “a minimum requirement of insurers.” Those are the systems the report says attackers now target.

Kroll’s Max Henderson told CINI that endpoint detection, managed detection and multi-factor authentication work. “We’ve forced their hand to adapt,” he said. The Acronis report documents another adaptation. Attackers switch the controls off.

“A security control may not be able to report that it has been disabled,” the report says. Acronis advises watching for the silence instead. Teams should independently monitor for agents that stop reporting. They should also watch for unexpected logging changes and edits to protected settings. An agent failure alongside a privileged login, new driver, or remote execution warrants a security investigation.

Round-the-clock monitoring matters for the same reason. Travelers’ Matthew Butler named EDR with 24/7 monitoring among three controls for a small manufacturer on the CINI podcast. Ransomware lands off-hours, he said.

For backups, Acronis advises keeping backup administration separate from routine endpoint access. Deletion and retention changes should need stronger approval. Recovery tests should assume the usual admin account or management server may be compromised.

MSP Security: One Login, Many Clients

MSP admin accounts, remote monitoring and management (RMM) tools and shared infrastructure can connect many customer environments, the report says. A compromise at one provider can travel well beyond its own operations.

Remote tools also pile up. Acronis examined more than 1.8 million endpoints running its own RMM software. On 63.1% of them, at least one other RMM or remote-access tool was installed. Some serve legitimate support needs, Acronis says. Others may linger after a provider change or sit open to an intruder. Acronis sells its own RMM product. The figure may include rival tools.

Access that outlives a relationship is a familiar gap. Most former employees in a Sagiss survey said their work access outlived the job, CINI reported. The report applies the same logic to providers. Obsolete agents and accounts should go when an MSP relationship ends.

Small firms lean on MSPs most. CyberFOX found 79% of IT teams under 15 people use an MSP for at least one function, CINI reported. Insurers help shape what those clients buy. One in five MSPs told Kaseya that compliance or cyber insurance requirements mainly drive client security spending.

A breach at one provider can reach many policyholders at once. That is the concentration question underwriters already model.

AI Agents Let One Operator Run A Campaign

Acronis’s BOSSAI investigation describes a single operator. They connected more than 10 commercial, open-weight, and modified AI models to offensive tools. AI agents handled reconnaissance, exploitation, and infrastructure management. Targets included emergency services and government systems in Taiwan. They also included universities in Thailand and financial targets in Mexico. The operator could direct the agents through the messaging apps WeChat and LINE.

AI is “helping capable operators coordinate more of the attack lifecycle,” said Santiago Pontiroli, Acronis’s threat intelligence research lead.

That fits what Henderson told CINI. “We are seeing many lone wolves operate with this. And that’s what AI creates,” he said. SOCRadar found one crew whose AI coding agent wrote hundreds of its attack tools.

Agent add-ons carry their own risk. TRU found more than 575 malicious skills for the OpenClaw agent platform across 13 developer accounts. They posed as legitimate utilities. They delivered trojans, crypto miners, and information stealers.

Acronis advises giving agents narrowly scoped identities. Restrictions should sit outside the model. A changed prompt then cannot widen an agent’s authority. Few agents identify themselves today. Only 2.3% of legitimate AI agent sessions carried a verified signature in Arkose Labs’ data, CINI reported.

Infostealers Turn One Laptop Into Many Logins

Infostealers are among the most frequently deployed payloads, the report says. They grab passwords, session cookies, tokens, cloud credentials and crypto wallets. A valid session cookie may let an attacker reuse a signed-in session without a new MFA challenge.

Insurers have seen the cost. Travelers reported business email compromise claims 57% higher in the first half of 2026. Session token theft drove much of the rise, CINI reported.

AI developer tools are a newer target. In the IronWorm campaign, malware in npm packages hunted AI provider API keys, the report says. It also sought credential files for AI coding assistants. Acronis cites the Cloud Security Alliance.

Cleaning the device does not close the incident, Acronis says. An infostealer detection should trigger an identity investigation. Responders should revoke sessions and tokens. They should rotate credentials and API secrets. If the identity carried MSP privileges, they should check whether the attacker reached other customers.

The lures reach every sector. In a campaign Acronis calls TamperedChef, signed, working apps posed as manual readers, PDF editors and games. About 80% of victims were in the US, Acronis telemetry showed. They clustered in health care, construction and manufacturing. Employees there often search online for equipment manuals.

The Patch Race

Gitea patched a critical flaw on July 27. A working public exploit appeared the next day. A group Acronis tracks as Red Heron adapted it to attack internet-facing Gitea servers. Confirmed compromises led to repository theft, credential collection, and lateral movement.

Defenders move more slowly. In the second half of 2025, third-party application patches took a median 5.7 days to install, Acronis found. The slowest 10% took more than 24.9 days. Those figures cover managed endpoints rather than Gitea servers, Acronis notes.

[CHART VIDEO: edr-killers-patch-race-acronis-2026.mp4]

WTW’s Glyn Thoms described the same contest in CINI’s PHP2Shell coverage. “This is a race between defenders applying an available fix and attackers turning public technical detail into repeatable exploitation.”

A patch may not end the exposure either. Cisco found persistence on some firewalls that survived upgrades to fixed releases, the report says. Confirmed compromises required reimaging. Acronis advises reviewing accounts, configuration changes and stored secrets after suspected exploitation.

Ransomware Moves To The Hypervisor

Ransomware brands keep multiplying. Acronis tracked nearly 100 active brands in the second half of 2025. Thirty-four were new to its dataset in that period. Qilin claimed 962 victims in those six months, more than any other group Acronis tracked.

Many of those brands share code. Lynx and Sinobi emerged with substantial overlap after INC’s source code went up for sale, the report says. Tracking those connections gives more warning than counting names, Acronis argues.

The targets are moving deeper too. LockBit 5.0 ships Windows, Linux, and VMware ESXi variants. On ESXi, it can shut down running virtual machines to encrypt their files. INC’s Linux and ESXi encryptor also deletes snapshots.

One hypervisor can carry many business services. A hit there can stop several at once. Acronis advises treating unexpected virtual machine shutdowns and snapshot deletions as early warnings.

On the CINI Podcast: AI Is Being Written Out Of Your Insurance

Insurers are writing AI exclusions into business policies, Erin Kenneally of DLTASKOP says. Many companies don’t know they’ve lost cover. Find it here.

FAQ – EDR Killers

What are EDR killers?

They are tools that disable endpoint detection and response software. Ransomware affiliates use them to blind defenders before encryption.

What is defense impairment?

MITRE added it as an ATT&CK tactic in April 2026. It covers deliberate interference with security tools, such as stopping endpoint agents or disrupting logging.

Why do EDR killers matter for cyber insurance?

EDR, secured backups and logging all appear on Marsh’s list of 12 key cyber controls. The Acronis report finds attackers now target those same systems.

How can a company tell if its EDR has been switched off?

Acronis advises independent monitoring for agents that stop reporting, unexpected logging changes and edits to protected settings.

Why does MSP security affect so many companies?

One provider’s admin accounts and remote tools can reach many clients. Acronis found 63.1% of endpoints running its RMM software had another remote-access tool installed.

How fast did attackers exploit the Gitea flaw?

A working public exploit appeared the day after the July 27 fix. Third-party patches on managed endpoints took a median 5.7 days to install, Acronis found.

Related Cyber Insurance Posts

• 7 Essential Cyber Insurance Requirements You Can’t Ignore(Opens in a new browser tab)
• Streamlined Cyber Insurance for Small Businesses: Acronis Partners with Mulberri(Opens in a new browser tab)
• Cyber Insurance Premiums Stabilize With Novbox Training | Acronis + Wizer Support Audits(Opens in a new browser tab)
• The “Downtime Era” Redefines Business Interruption Risk – Absolute Security(Opens in a new browser tab)