Data backups have become a top target for ransomware actors, according to a report from a cybersecurity company.

A startling 94% of organizations that experienced ransomware attacks in the previous year reported that the attackers made an effort to compromise their backup systems, according to a recent study by Sophos that involved polling about 3,000 IT and security experts from 14 different countries.

For organizations in the government, media, leisure, and entertainment sectors, the percentages were even higher, reaching 99%.

The report outlined the two primary methods for recovering encrypted data in a ransomware attack: restoring from backups or opting to pay the ransom.

“By compromising an organization’s backups, ransomware actors can severely limit the victim’s ability to recover encrypted data, thereby increasing the pressure to pay,” stated the researchers.

“It has become a routine occurrence for these individuals during their attacks,” commented Curtis Fechner, the head of cybersecurity threats at Optiv, a Denver-based provider of cybersecurity solutions.

He mentioned to TechNewsWorld that they constantly attempt to locate and render the backups inaccessible. One aspect of their strategy for earning money involves identifying the backups, as they aim to maximize their potential revenue from an attack.

“By taking your backups offline and using them as leverage for recovery, I have increased the likelihood of you paying. Furthermore, I can exploit your desperation to extract even more from you.”I understand that you’re in a difficult situation,” Fechner added.

Growing Threat
According to Ilia Sotnikov, a security strategist and the vice president of user experience at Netwrix, an IT security software company headquartered in Frisco, Texas, enterprise ransomware was not very sophisticated when it first emerged about 10 years ago.

The ransomware malware quickly spread through the system by taking advantage of weak configurations or vulnerabilities and encrypting any data it came across. According to him, the victim was forced to pay a ransom in order to regain access to their operations.

“The cybersecurity industry has implemented a comprehensive security strategy that includes enhanced protection and detection capabilities, as well as a strong focus on backup and recovery practices,” he stated. Due to their expertise, organizations were able to successfully deflect the majority of attacks, significantly reducing the number of successful ones. Additionally, they gained valuable knowledge on how to efficiently restore systems and operations without resorting to paying a ransom.

Furthermore, he explained that the ransomware strategy underwent changes to enhance the likelihood of success by exploring alternative methods to overcome security measures. Malware has become increasingly difficult to detect and combat. The criminals began to allocate additional time to the reconnaissance stage in order to pinpoint and focus on the most vulnerable information. Groups such as Maze and LockBit began to extract the company’s data and introduced the additional risk of a public data leak alongside the encryption, a tactic referred to as double extortion.

“Since then,” he noted, “ransomware attackers have also begun targeting the backups to render recovery impossible or excessively expensive, compelling the victims to pay the ransom.”

Backups are currently down, while ransom demands are on the rise.

According to Sophos, people who had their backups compromised faced ransom demands that were typically more than twice as high as those who were not. For victims with compromised backups, the median ransom demands amounted to US$2.3 million, while those with uncompromised backups faced demands of $1 million.

Backups are essential for the smooth operation of organizations. According to Darren Guccione, CEO of Keeper Security, a password management and online storage company in Chicago, if the backup is compromised and the organization falls victim to a cyberattack, they may become more desperate to regain access to their networks and data.

“Attackers are well aware of the impact of denying access to backups, which leaves organizations in a vulnerable position and with limited choices other than complying with exorbitant ransom demands in order to retrieve their data,” he explained to TechNewsWorld.

The Sophos research provided evidence to support the fact that organizations with compromised backups are unable to negotiate with ransomware actors. It was discovered that individuals who had compromised backups ended up paying an average of 98% of the ransom demanded, while those without compromised backups paid 82%.

According to the report, organizations that had their backups compromised were significantly more inclined to pay the ransom in order to retrieve their encrypted data (67%), compared to those whose backups remained unaffected (36%).

Increased Cost of Restoration
Victims who have compromised backups not only face the burden of paying higher ransoms, but they also incur additional costs when it comes to recovering from an attack.

The median overall recovery costs for organizations whose backups were compromised were eight times higher at $3 million, compared to those whose backups were not impacted at $375,000.

Guccione outlined the various expenses that organizations face when they become targets of ransomware attacks. These include the financial impact of disrupted operations and harm to their reputation, the extensive efforts required for recovery in the short and long term, the actual ransom payment, and the potential consequences of fines and legal obligations.

“When a ransomware attack affects backups as well, it greatly extends the restoration process. Organizations are then required to rebuild their systems, data, and other crucial configurations,” he explained. If a breach involves a loss of sensitive data, especially if it includes personally identifiable information or falls under data protection regulations like GDPR or HIPAA, organizations may face additional legal and regulatory expenses.

As per the Sophos report, organizations with compromised backups experience longer recovery times from ransomware attacks. Just 26% of individuals who had their backups compromised were able to recover within a week after an attack, in contrast to 46% of those who did not have compromised backups.

Offline Backups: Balancing Security and Cost
There are various factors that contribute to the difference in restoration times between organizations with compromised and uncompromised backups, as highlighted in the report. One significant factor is the extra effort required to restore data from decrypted sources instead of well-prepared backups. Additionally, the presence of weaker backup protection may suggest less resilient defenses and a greater need for subsequent rebuilding efforts, according to the statement.

According to Narayana Pappu, the CEO of Zendata, a data collection, management, and sharing company based in San Francisco, backups usually lack the same level of security controls as production systems.

“Implementing logging, security measures, access controls, and testing on backup systems would be highly beneficial,” he advised TechNewsWorld. In addition, it is crucial to have redundant backups stored in various locations, including both cloud storage and offline storage. Implementing a comprehensive disaster recovery strategy can significantly minimize downtime.

According to Fechner, offline backups are effective in protecting against threats to backups, but they can also be quite costly. “Having backups that are offline and inaccessible to attackers is crucial,” he emphasized. However, considering the financial constraints faced by numerous organizations, particularly those in the small to medium business category, targeting backups remains a lucrative strategy for attackers.