Attackers go for the backups now. Plan for that

For a long time the backup was the thing you fell back on after an attack. This week's news is a reminder that attackers know that too. They now look for the backup server on the way in, and they get there fast.

What happened this week

Palo Alto Networks' Unit 42 team has been tracking ransomware groups, including Qilin and Inc, who get in through a flaw in GlobalProtect VPN, CVE-2026-0257. Once inside, they used RMM tools to look around and moved between machines over RDP and SMB. In one case they reached vCenter, switched off a security control on the ESXi hosts and pulled credentials from a domain controller's virtual disk. Unit 42 also saw them use exploit tools against Veeam Backup & Replication, including CVE-2023-27532, a flaw that can expose stored credentials. The reports don't say backups were deleted in these cases, but the intent is clear: find the backups early.

Speed is the other half of the story. Rapid7's Q3 report says high-severity flaws were exploited three days after disclosure on average, and 71% within a week. And on 21 October, when LiteLLM's release pipeline was hacked to ship a credential stealer, the project's advice included rebuilding infected systems from clean backups. That only works if the backups are still there and still clean.

A backup only counts if they can't delete it

If an attacker gets admin rights to your backup console, they can often delete restore points the same way you can. So the question isn't "do we have backups?" It's "could someone with stolen admin credentials wipe them?"

This is what immutable storage is for. In Acronis, it keeps deleted backups for a set retention period, so a backup deleted by hand, or by a retention rule, can still be recovered until that period runs out. Acronis offers two modes:

Governance mode: deleted backups stay locked for the retention period. You can still change the period, and only Acronis Support can turn it off.
Compliance mode: the same, but the retention policy can't be changed or turned off at all. Choosing it can't be undone.

The retention period runs from 14 to 3,650 days, with 14 as the default. Acronis says Governance mode with 14 days may already be switched on automatically for tenants since September 2024, so check what your tenants actually have rather than assuming. Note that it works with cloud storage only, needs TIBX backups and a recent agent, and deleted backups held in immutable storage still take up billable space.

Acronis has also renamed its platform: Acronis Cyber Protect Cloud is now called Acronis Cyber Platform, and a new Cyber Console is in early access. The settings below may move as that rolls out, so check the current docs.

What I'd check this week

Immutability is on, at a sensible period. Fourteen days is the minimum. Ask yourself honestly how long it would take you to notice a deleted backup. If the answer could be more than 14 days, set a longer period.
The backup console has its own strong sign-in. MFA on every admin account, and no shared logins. If the backup admin uses the same password as their domain account, a domain compromise is a backup compromise.
Backup servers aren't reachable from everywhere. VPN users who don't need the backup server or vCenter shouldn't be able to reach them. The Unit 42 cases show how one VPN login can turn into access to everything.
Backup software is patched fast. The Veeam flaw being used here dates from 2023. Backup servers are often the ones nobody wants to reboot, which is exactly why they fall behind.
You've tested a restore recently. Pick one machine, restore it, and time it. A backup you've never restored is a hope, not a plan.
You know what "clean" means. If a machine was infected on a known date, you need restore points from before that date. Make sure retention keeps enough of them.

The bottom line

Backups are now part of the attack surface, not just the recovery plan. Put them behind their own credentials, keep deleted copies locked for long enough to matter, and test that you can actually get data back. I've written a step-by-step guide to switching on immutable storage in Acronis today if you want to start there.

Sources

← All posts