Full Report
Ransomware resilience requires more than backups or endpoint detection alone. Acronis outlines six capabilities MSPs should test across client environments, from reducing exposure and detecting attacks to preserving recovery points and restoring operations quickly. [...]
Analysis Summary
# Morning News Roll-up September 2, 2026
## Overview
Today's intelligence focus highlights the evolving ransomware landscape targeting Managed Service Providers (MSPs), emphasizing that standard backups are no longer sufficient. Key findings from Acronis indicate a rise in targeted attacks against IT service providers, necessitating a shift toward integrated prevention, detection, and "clean" recovery workflows.
## Top Stories
### Ransomware Protection for MSPs: A 6-Point Resilience Framework
- Summary: Acronis reports 143 MSP and telecom ransomware victims in 2025, primarily driven by phishing (52%) and unpatched vulnerabilities (27%). The report outlines a mandatory six-point checklist for MSPs to move beyond simple backups toward cyber resilience. This includes reducing exposure via MFA and patch SLAs, behavioral detection before encryption occurs, 24/7 MDR response, and the use of immutable, access-separated recovery points to prevent attackers from deleting backups.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/ransomware-protection-for-msps-a-6-point-checklist-for-faster-recovery/
### Anthropic Warns of Infostealer Hijacking Claude Sessions
- Summary: A new campaign involving infostealer malware is specifically targeting Claude AI sessions. The malware hijacks active sessions to drain usage limits and potentially access sensitive prompts or data stored within the AI interface.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/
### Chrome Web Store Extensions Caught Stealing Crypto and Data
- Summary: Security researchers identified several malicious extensions on the Chrome Web Store designed to exfiltrate cryptocurrency wallet credentials and sensitive browser data, highlighting ongoing risks in the browser extension ecosystem.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/
---
# Managed Service Provider (MSP) Ransomware Resilience
MSPs are increasingly targeted by ransomware actors who leverage their high-privilege access to compromise multiple downstream clients. Resilience requires a holistic integration of EDR, XDR, and immutable backups to ensure that recovery is not only possible but free of reinfection.
## Key Points
- **Backup Limitations:** Traditional backups are insufficient if they can be deleted by a compromised technician account or if they contain dormant malware that reinfects the environment upon restoration.
- **2025 Statistics:** 143 MSP, IT-service provider, and telecom organizations were confirmed ransomware victims in 2025.
- **Initial Access Trends:** Phishing remains the dominant vector (52%), followed by the exploitation of unpatched vulnerabilities (27%).
- **Verification of Controls:** MSPs must provide evidence of outcome-based security, such as testing if a compromised credential can delete recovery points and validating Recovery Time Objectives (RTO).
## Threat Actors
- **Unspecified Ransomware Groups:** Various actors are targeting MSPs to achieve "one-to-many" impact.
- **Motivations:** Primarily financial extortion, utilizing the leverage of service disruption across multiple organizations.
## TTPs
- **Phishing (T1566):** Used in 52% of successful initial access attempts.
- **Exploitation of Unpatched Vulnerabilities (T1190):** Used in 27% of cases.
- **Internal Reconnaissance & Lateral Movement:** Aimed at identifying management portals and remote access tools.
- **Data Deletion/Impairment (T1485):** Attempting to delete recovery points or change protection policies using compromised administrative credentials.
- **Endpoint/Identity Hijacking:** Monitoring for EDR/XDR bypasses to initiate widespread encryption.
## Affected Systems
- **MSP Management Portals:** Centralized tools used for remote monitoring and management (RMM).
- **Identity Providers:** Compromise of technician accounts for cross-tenant access.
- **Microsoft 365 Environments:** Specifically targeted for data exfiltration and identity signals.
- **Recovery Infrastructure:** Standard backup storage lacking immutability or air-gapping.
## Mitigations
- **Identity Security:** Enforce MFA for all management portals and remote access tools.
- **Role Separation:** Separate backup administration from security administration to prevent a single point of failure.
- **Immutable Storage:** Utilize access-separated, immutable, or offline copies of data that delay or prevent deletion.
- **Clean Recovery Workflows:** Implement mandatory malware scanning of recovery points before restoring them to production.
- **Behavioral Testing:** Conduct controlled tests to ensure EDR/XDR triggers an incident before encryption occurs.
- **Vulnerability Management:** Establish strict Patch SLAs based on severity to close the 27% exposure gap.
## Conclusion
The threat to MSPs has shifted from simple data encryption to the strategic destruction of recovery capabilities. Analysts recommend that MSPs move away from "flat" client policies and instead adopt a multi-tenant management layer that supports 24/7 MDR and immutable recovery. The distinction between immutable, offline, and air-gapped storage must be strictly maintained and verified to ensure operational continuity following a compromise.