By Rick Vanover, Senior Director of Product Strategy, Veeam Software

Ransomware has dominated the security conversation in recent years. But despite this, many people and organisations still don't understand how these attacks unfold. 

Ransomware attacks don't happen instantly - it's not one malicious link and then lockdown. Instead, attacks can be years in the making, from initial observations and break-ins to declaring the ransom. For example, reports suggest Clop may have been sitting on its MOVEit exploit as far back as 2021. So, what is the timeline of a ransomware attack, and why must businesses understand this to improve their ransomware resilience? 

Understanding the attack timeline 

It’s a common misconception that ransomware attacks just happen out of the blue. Cybercriminals often like to take their time, taking the scenic route through your business and getting to know it inside out. 

The ransom stage is the only part of the process that’s visible. This is when attackers announce their presence, but, as highlighted by investigations into this year’s MOVEIt hack (the biggest hack of 2023 so far), they can spend years behind the scenes. So, what is happening in the lead-up to the ransom demand? 

First, attackers start with an observation stage. This time is spent gathering as much information as possible on the target organisation, including its people, processes, and technology. This could take months. After enough intel has been gathered, attackers will move to infiltrate their target’s system, gaining access through a preliminary attack, commonly a phishing email. 

After establishing entry, attackers will set up camp within the organisation’s IT infrastructure, creating a base of operations from which they can elevate their access and make lateral movements. They do some of the most significant damage at this stage, snooping around undetected and compromising identified high-value targets. They can take their time over this, making as many moves as possible to ensure maximum exploitation. 

After this, attackers spend time crippling recoverability. This involves altering backup routines, documentation, and security systems to reduce or completely deny restore capabilities. So, before the organisation is even aware of the attack, it’s too late to turn to its backup. Things are heating up at this stage, finally coming to a head with the declaration of ransom. As well as announcing their presence and making demands, cyber criminals at this final stage will encrypt their victim’s data and wipe all records and backups. This entire process might unfold over the course of a year or even multiple. 

 Making your backup bulletproof 

The discovery that malicious actors can inhabit your systems unseen for a year or more while you’re none the wiser can be daunting for businesses. But it’s crucial knowledge and never fails to create a sense of urgency when implementing a robust data security strategy. Every minute your business passes without this in place is another minute that cybercriminals can carry out the groundwork that will later cause a lot of pain.

So, armed with this knowledge, what steps do businesses need to take? The biggest concern is the usability of backups for recovery after an attack. Suppose your system was breached a year ago without your knowledge. In that case, there’s a very high likelihood that your backups are impacted, meaning you’ll try to restore your data using a compromised backup. Fortunately, this can be avoided with the proper preparation and the right backup strategy in place. 

Getting hit by a ransomware attack is almost inevitable for the modern enterprise, with 85% of organisations experiencing at least one cyber-attack in 2022, nearly 10% more than the previous year. Moreover, as cybercriminals increasingly target backups, the road to recovery can be longer than ever. 

Thinking of ransomware attacks as a case of ‘when’, not ‘if’, means recognising that you will need to use your backup to restore your critical data when the time comes. Acknowledging this should spur businesses to invest serious time and resources to ensure their backups are ironclad. 

This is possible by following the golden rule of backup: 3-2-1-1-0. This requires three copies of data stored on two different media, one stored off-site and one air-gapped and immutable. Across these copies, there needs to be zero errors. Working under the assumption that cybercriminals will target your backup means taking precautions so you retain at least one untouched copy to use for your recovery. It’s like keeping your money in a bank and making copies of essential documents in case your house gets burgled - thieves will target your safe, so storing valuables offsite and making copies provides peace of mind. 

Implementing a 3-2-1-1-0 backup strategy isn’t a one-time thing. You must constantly monitor and test your backups, checking for errors and cleaning your data as needed. Cybercriminals rely on businesses not doing this - you can stay one step ahead by remaining strict on your data strategy. 

Controlling the chaos 

Ransomware is a disaster, and disaster recovery takes time. According to the latest Veeam Ransomware Trends Report, most businesses take at least three weeks to recover from a ransomware attack. It’s important to note that this recovery time starts after the company has triaged. This investigative stage can be extensive, and its impact on recovery timelines is hard to predict and overstate. At this stage, the business needs to identify the source of the attack and the extent of the damage, and they may even face yellow tape if government bodies need to drive the investigation.

During this time, the business is still compromised. In the worst-case scenario, it might have been forced to cease operations entirely while the breach is investigated and resolved. It goes without saying, but it isn't making money if a business isn’t operating. Worse than this, costs are spiralling as it is resource-intensive to recover from a large-scale attack, with IT departments and key stakeholders working round the clock, and there are legal fees and compensation costs to account for, as well as reputational damage. 

It’s hard to predict how long a recovery process will take because ransomware is a disaster with a difference. Suppose you’re recovering from a natural disaster like a fire. In that case, you can trust your last known backups or replicas and use them to begin recovery immediately, safely knowing that the backups haven’t been interfered with. This is not the case with a cyber disaster, which considerably lengthens recovery time. It takes time to identify which servers are infected and to determine whether backups and replicas are also affected (if they are, they can reintroduce the ransomware to your infrastructure, sending you right back to square one). 

However, while ransomware is a severe threat and can potentially cause widespread damage, there are measures businesses can take to reduce the recovery time and the extent to which they can be compromised. As mentioned, the golden 3-2-1-1-0 backup rule is a critical tool in your arsenal. While ransomware attacks are inevitable and backups increasingly targeted, by implementing a robust data backup strategy, you always have a clean copy of your data to fall back on.