Backups The Latest Malware Target

guest · Oct 3, 2019

Backups The Latest Malware Target
October 3, 2019
https://www.forbes.com/sites/justinwarren/2019/10/03/backups-the-latest-malware-target/

“We're seeing a trend of bad actors trying to get into the backup systems.”
Tim Sheahen, Senior Director of Sales, Carbonite
These days it's not even enough to just have backups, as some ransomware variants are—I am told—actively targeting the backup systems themselves, and thus robbing customers of an effective recovery option. The backup systems themselves need to be resilient again malware infections, and a variety of data protection vendors are investing in this direction.

By including Sophos' security products on the Arcserve appliance itself, Arcserve is able to detect and stop a ransomware attack on the backup infrastructure itself [...]
Carbonite recently acquired security vendor Webroot and Carbonite is adding Webroot's malware protection capabilities into its products.

"We're seeing a trend of bad actors trying to get into the backup systems," says Tim Sheahen, Senior Director of Sales at Carbonite. "We're putting measures in place to make sure those are protected."
Click to expand...

Too often data protection is an afterthought, a particularly boring kind of insurance that no one wants to think about.

Dealing with a ransomware attack is the kind of exciting you really don't want to experience.
There is too much money to be made, and people respond to incentives.
Click to expand...

guest · Feb 27, 2020

Ransomware victims thought their backups were safe. They were wrong
Ransomware victims are finding out too late that their vital backups are online and also getting encrypted by crooks
February 27, 2020
https://www.zdnet.com/article/ransomware-victims-thought-their-backups-were-safe-they-were-wrong/

The UK's cyber security agency has updated its guidance on what to do after a ransomware attack, following a series of incidents where organisations were hit with ransomware, but also had their backups encrypted because they had left them connected to their network.

Keeping a backup copy of vital data is a good way of reducing the damage of a ransomware attack: it allows companies to get systems up and running again without having to pay off the crooks. But that backup data isn't much good if it's also infected with ransomware -- and thus encrypted and unusable -- because it was still connected to the network when the attack took place.

"We've seen a number of ransomware incidents lately where the victims had backed up their essential data (which is great), but all the backups were online at the time of the incident (not so great). It meant the backups were also encrypted and ransomed together with the rest of the victim's data," the agency warned.
While the NCSC has previously recommended offline backups, it said recent incidents, such as attacks by the Trickbot banking trojan malware, suggested greater emphasis was needed.
Click to expand...

NCSC - Updated guidance: Thread

guest · Mar 5, 2020

Ransomware Attackers Use Your Cloud Backups Against You
March 5, 2020
https://www.bleepingcomputer.com/ne...attackers-use-your-cloud-backups-against-you/

It should be noted that in this article we will be focusing on the Veeam backup software. Not because it is less secure than other software, but simply because it is one of the most popular enterprise backup products and was mentioned by the ransomware operators.
Attackers first use your cloud backups to steal your data
During ransomware attacks, attackers will compromise an individual host through phishing, malware, or exposed remote desktop services.

When Maze finds backups stored in the cloud, they attempt to obtain the cloud storage credentials and then use them to restore the victim's data to servers under the attacker's control.
With a victim's data now stolen and their backups deleted, the attackers deploy their ransomware throughout the compromised network using PSExec or PowerShell Empire typically during off-hours.
Click to expand...

Protecting your backups
In emails with Rick Vanover, Senior Director, Product Strategy at Veeam Software, we were told that it does not matter what software you use, once an attacker gains privileged access to the network, everything is at risk.

"We have advocated, even in a published 2017 whitepaper that I wrote I’ve recommended separate accounts for Veeam installations and components. [...]

Like Veeam, Nero Consulting also strongly recommends users should purchase the immutable storage or redundant storage protection options if available when using cloud services.
Using this option, even if the data is deleted from the cloud storage provider, the immutable storage service will make the data recoverable for a certain amount of time.
Click to expand...

guest · Nov 7, 2020

How to protect backups from ransomware
Ransomware is getting smarter, attacking backups to prevent recovery
November 2, 2020
https://www.csoonline.com/article/3331981/how-to-protect-backups-from-ransomware.html

Despite a recent decline in attacks, ransomware still poses significant threats to enterprises, as the attacks against healthcare organizations demonstrated this month. It is also becoming more capable. In particular, ransomware writers are aware that backups are an effective defense and are modifying their malware to track down and eliminate the backups.
Ransomware targeting backups
Ransomware will now delete any backups it happens to come across along the way, says Adam Kujawa, head of malware intelligence at Malwarebytes. For example, a common tactic for ransomware is to delete automatic copies of files that Windows creates. "So, if you go to system restore, you can't revert back," he said. "We've also seen them reach out to shared network drives."

You can protect your backups and systems from these new ransomware tactics by taking a few basic precautions.
Click to expand...

Supplement Windows backups with additional copies and third-party tools
To defend against ransomware that deletes or encrypts local backups of files, Kujawa suggests using additional backups or third-party utilities or other tools that aren't part of the default Windows configuration.
Isolate the backups
One common mistake is when users have the same authentication method for their backups as they use elsewhere, says Landon Lewis, CEO at Pondurance, an Indianapolis-based cybersecurity services firm.

"If your user’s account is compromised, the first thing the attacker wants to do is escalate their privileges," he said. "If the backup system uses the same authentication, they can just take over everything."
Keep multiple backup copies at multiple locations
Lewis recommends that companies keep three different copies of their important files, using at least two different backup methods, and at least one of them needs to be at a different location. Cloud-based backups provide an easy-to-use, off-site backup option, he says.
Click to expand...

Test, test, test your backups
Many companies only find out that their backups didn't take, or are too cumbersome to get back, after they've fallen victim to an attack. "If you haven't done some type of restoration exercise and it's not documented and nobody is familiar with it, we still see a lot of clients consider paying, and in some cases actually doing so, because paying the attacker is actually operationally cheaper," Lewis says.
Click to expand...

Log in or Sign up

Backups The Latest Malware Target

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Backups The Latest Malware Target

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches