Ransomware, storage and backup: Impacts, limits and capabilities

How do ransomware attacks work?

The conventional path for ransomware into an organisation is through an infected attachment that contains an executable file, or by conning users to visit a website that contains malware. That injected software deploys on the network and seeks out its targets.

Double- and triple-extortion attacks create backdoors into systems that allow the attackers to exfiltrate data. Increasingly, this goes hand in hand with disabling backups and attacks on core network services such as Microsoft Active Directory.

The latest generation of ransomware attacks target backup systems, appliances and virtual machines. “They are targeting physical appliances and virtualised appliances,” says Oisin Fouere, head of cyber incident response at consulting firm KPMG.

“A lot of backup systems are hosted on virtual infrastructure. They have started targeting and deleting operating system-level information on those systems, as well as going after the bare bones of the systems.”

And as Kroll’s Iacono points out, ransomware groups often recruit people with technical knowledge of backup systems.

But first, the ransomware has to enter the corporate network. The conventional – and still most common – approach is to use a phishing attack or other form of social engineering to deliver infected attachments or convince employees to click on infected web links.

During Covid lockdown, ransomware groups exploited weaknesses in virtual private networks and remote desktop systems, which caused a spike in ransomware cases.

“There was a lot of exposure around poorly protected or inadequately configured remote access systems, which meant attackers didn’t need to spend time trying to solve the intrusion vector problem,” says KPMG’s Fouere. “They were almost being presented with a front-door-left-open scenario, and that was a favourite choice over the past couple of years.”

The hardening of these access points is behind a recent fall in ransomware incidents – but this is no cause for complacency, experts warn.

Keith Chappell, a cyber security expert at PA Consulting, says we are seeing “more deliberate, more targeted and better-researched attacks that actually have a purpose, be that to disrupt operations … or to extort to make money”.

How does a ransomware attack impact storage and backup?

Ransomware attacks set out to deny access to data. Early-generation attacks targeted disk drives, often on individuals’ PCs, with fairly low-grade encryption methods. Victims could obtain a decryption code for a few hundred dollars.

However, modern attacks are both more selective and more damaging. Attackers increasingly use reconnaissance to find high-value targets. These include personally identifiable data (PII), such as customer, commercial or health records, or intellectual property. These are the files firms will most fear being released in public.

“Very often, a phishing attack or ransom attack can be used as a masking technique for something else that is going on, or can be masked by doing something else”

But attackers also target networks and identity and access management data, operational systems, including operational technology, and live data flows, as well as backups and archives. Double- and triple-extortion attacks that go after backups or disaster recovery and business continuity systems offer the greatest chance of a payout. Without the ability to recover a system or restore data from backups, firms may have little choice but to pay up.

Attackers also look for accounts they can compromise and use to escalate privileges, to carry out further, or deeper attacks. So, security teams need to secure not just main data stores, but also administrative systems.

“Very often, a phishing attack or ransom attack can be used as a masking technique for something else that is going on, or can be masked by doing something else,” says PA Consulting’s Chappell.

How do storage and backup help in case of a ransomware attack?

Even though criminal hackers actively target backups, these remain the best defence against ransomware.

Firms need to ensure they take regular backups and that these are immutable, stored off-site, or ideally, both. “You should be backing up data daily, weekly and monthly, and you should be storing backups in physically separate, disconnected locations, ideally in different formats,” says Chappell.

Much has been said about the need to “air gap” data from systems that might be attacked, and nowhere is this more important than for storing backup copies. However, older backup media, such as tape, are often too slow to allow a full recovery in the timescales the business demands.

“Organisations realised they can’t wait several months for these tape backups to restore,” says KPMG’s Fouere. Instead, clients are looking at cloud-based resilience and recovery, primarily for speed, he says.

In turn, backup suppliers and cloud service providers now offer immutable backups as an extra layer of protection. High-end, active-to-active business continuity systems remain vulnerable to ransomware as data is copied from the primary to the backup system. So, firms need solid backup and ways to scan volumes for malware before they are used for recovery, and ideally, as data is being saved.

But IT organisations also need to take steps to protect backup systems themselves. “They are vulnerable, too, just like any other software product is,” says Kroll’s Iacono. “You have to make sure that backup systems are patched. We have had cases where threat actors leverage vulnerabilities in backup systems to help them with data exfiltration or to evade detection.”

Some IT teams are going even further. With ransomware groups spending more time on reconnaissance, firms are obscuring the names of servers and storage volumes. This is a simple, low-cost step to avoid using obvious labels for high-value data stores, and it might buy valuable time when it comes to shutting down an attack.

What are the limits of storage and backup as protection against ransomware?

Good discipline around data backups has reduced the effectiveness of ransomware attacks. This may explain why cyber crime groups have moved to double- and triple-extortion attacks, targeting backup systems and exfiltrating data.

“[Backup systems] are vulnerable, too, just like any other software product is. You have to make sure [they] are patched. We have had cases where threat actors leverage vulnerabilities in backup systems to help them with data exfiltration or to evade detection”

Using immutable backups alongside disk or cloud storage still minimises the impact of ransomware. But firms need to ensure that all parts of critical systems are fully protected – and this includes testing. Even if the main data store is backed up, a system can fail to restore if operational or administration data is encrypted because they have been left off the backup plan.

Firms also need to allow for data restoration where good backups do exist. Even with the latest backup and recovery tools, this is still a disruptive process.

Also, immutable backups will not prevent data exfiltration. Here, firms need to invest in the encryption of data assets. They can only do this if they have an accurate, up-to-date understanding of where their data is. Organisations should look at monitoring tools that can detect unusual data movements and invest in protecting privileged user accounts.

With most ransomware still spread by phishing and social engineering, firms can take technical steps to protect their perimeter.

But training staff to spot suspicious emails, links and attachments, coupled with multifactor authentication, are the strongest defence against ransomware. For ransomware, as with other forms of fraud and online crime, security awareness is an essential part of defence in depth.