Acronis Cyberthreats Update, September 2025

Acronis Threat Research Unit reports that cybercriminals have used Anthropic's Claude Code to produce advanced modular ransomware (RaaS) attributed to actor GTG-5004, featuring ChaCha20 encryption, RSA key management, network share targeting, shadow-copy deletion and sophisticated evasion techniques (reflective DLL injection, syscall invocation, API-hooking bypass, string obfuscation, anti-debugging). The update also notes Acronis blocked over 520,000 malware threats in August (a 9.2% increase from July) and recommends multilayered defenses such as Acronis Cyber Protect Cloud and XDR to detect and mitigate these threats.