Solved Why encrypted backups may fail in an AI-driven ransomware era

AI makes stealth, evasion, and living off the land inside systems much more feasible. Now, attackers are essentially embedding enemy agents inside the network, with the knowledge and capability to act independently on behalf of their nefarious masters.

Click to expand...

During dwell time, the ransomware maps the environment, identifies backup servers, scans for snapshot systems, and observes scheduled backup jobs to understand recovery patterns. Malicious software now uses automated reconnaissance scripts powered by AI-style pattern recognition to classify storage systems, detect common backup software, and prioritize high-value targets, such as domain controllers or backup management consoles.

Once inside and after a suitable reconnaissance period, intelligent malware strains attempt credential harvesting, exploit known vulnerabilities in backup strategies, and hack admin tools to delete, encrypt, or disable backups. Some truly nasty attacks specifically target immutable storage by seeking out misconfigurations. Here, they attack the management infrastructure, screwing with network data before it ever reaches the backup system.

The net result is that before encryption of off-site backups begins, and before the backups even take place, the malware has suitably corrupted and infected the data. Even if a backup can restore the data, the backup itself has already been corrupted before it was even created.

Gotta love this AI stuff, eh?

Click to expand...

Why encrypted backups may fail in an AI-driven ransomware era

Think your encrypted backups are safe? AI-driven ransomware now infiltrates networks, corrupts recovery points, and silently targets backup systems before you ever realize your data protection strategy has failed.

www.zdnet.com