Ransomware Groups Target Kaseya Backup Infrastructure, Elevating Recovery Risks

En bref

• Ransomware groups are focusing on backup infrastructure, specifically Kaseya products.
• The goal is to destroy recovery capabilities and force payment.
• Defenders are urged to adopt isolated, immutable, and tested backups.

Ransomware operators have shifted tactics, now focusing their attacks on backup systems from Kaseya. This direct assault on recovery systems is designed to strip victims of their ability to restore data without paying. By compromising backup solutions, attackers can delete or encrypt backups, leaving organizations with few options.

The K-12 sector and other government entities relying on Kaseya backup products are at risk. When backups are compromised, recovery becomes impossible, and the only apparent path forward is meeting the ransom demand. This increases the likelihood of payment and amplifies the operational and financial damage.

This focus on backups is not new, but it has intensified. Ransomware groups understand that resilient backups are the last line of defense. To counter this, security experts consistently recommend three practices: keeping backups isolated from the main network, making them immutable so they cannot be altered, and regularly testing restoration procedures. These steps reduce the leverage attackers gain from destroying backups.

For New Brunswick schools and similar organizations, the implications are serious. Loss of backup integrity can halt critical services, from student information systems to email. The absence of CVEs in this report suggests the threat is not tied to a specific software flaw but rather to misconfigurations or credential compromise. Administrators should assume their backup infrastructure is a prime target.

What to watch: Kaseya may release guidance or patches. Ransomware groups will likely continue to refine methods for disabling backup tools. Organizations should audit their backup configurations immediately and ensure offline copies exist. Monitoring for unauthorized access to backup consoles is also crucial.

À faire maintenant

1. Verify that backups are isolated from production networks, either air-gapped or logically separated.
2. Enable immutability on backup repositories where supported, ensuring retention locks cannot be overridden.
3. Conduct a test restoration of critical systems from backups to validate integrity and recovery time.
4. Restrict access to backup management interfaces using least privilege and multi-factor authentication.
5. Monitor backup logs for unusual deletion, encryption, or configuration changes.
6. Apply any available updates or security patches for Kaseya backup products.
7. Develop a contingency plan for backup compromise, including offline recovery alternatives.

Source originale

BleepingComputer