SoylentNews is people
SoylentNews
Ransomware Attackers Use Your Cloud Backups Against You:
Backups are one the most, if not the most, important defense against ransomware, but if not configured properly, attackers will use it against you.
Recently the DoppelPaymer Ransomware operators published on their leak site the Admin user name and password for a non-paying victim's Veeam backup software.
This was not meant to expose the information to others for further attacks but was used as a warning to the victim that the ransomware operators had full access to their network, including the backups.
After seeing this information, I reached out to the operators of the DoppelPaymer and Maze Ransomware families to learn how they target victim's backups and was surprised by what I learned.
It should be noted that in this article we will be focusing on the Veeam backup software. Not because it is less secure than other software, but simply because it is one of the most popular enterprise backup products and was mentioned by the ransomware operators.
(Score: 5, Insightful) by maxwell demon on Sunday March 08 2020, @08:49PM (1 child)
Of course that doesn't protect you against the attacker simply deleting your backup. I also imagine that when having your credentials, the attacker could simply change the password, making not only the existing backups unavailable to you, but also preventing the creation of new backups at that service.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 3, Informative) by vux984 on Sunday March 08 2020, @11:57PM
Amazon S3, object locking; retention mode. Once an object is in a container with a locking policy. Nobody can delete or modify the object. Nobody can reduce the retention policy length, nobody can delete the container the data is in. And even if the root user account is, amazon apparently doesn't delete it for 90 days.