New Ransomware Gangs Hitting Old Backup Exploits

TL;DR: In this blog, we discuss how “do it yourself” backup solutions continue to be targeted by bad actors and ransomware gangs who exploit known vulnerabilities, even those with published fixes, as they know that not everyone has actually applied those updates.

What’s Old is New Again!

When software vendors uncover a flaw or exploit in their solution they usually act pretty quickly to develop and release a fix or patch for the software and let their customers know about the problem and to apply the fix.  With the exploit identified and the problem patched the vendor typically washes their hands of the issue as they can rightfully claim “Hey, we fixed it”.

The problem is that just because the vendor fixed the problem on their end, doesn’t mean that your IT environment using that product is fixed.  The patches are available, but did you see the notice to apply them?  Were you even aware of the issues or if they affected you?  Even if you did know about the problem, did you apply the patch/fix?  Maybe the environment is very active (or very delicate) and you simply aren’t able or willing to apply that fix - rolling the dice that the “bad guys” won’t target you or your data.

Well, I had to call the bluff, but ransomware gangs are actively hunting the open web to look for you specifically.  You see, when a vendor publishes a new security flaw (known as Common Vulnerabilities and Exposures or CVEs for short) it gets added to a publicly available listing of flaws and their respective fixes/patches for everyone to reference - good guys and bad guys.

The ransomware gangs are relying on the fact that just because the vendor patched the hole, doesn’t mean everyone actually fixed their instance of that software.  They are betting that you either didn’t, couldn’t, or wouldn’t apply those patches and that despite there being a proper fix to the exploit you are still sitting vulnerable.

Old Exploits. Current Vulnerabilities

In July 2024, The Hacker News published an article highlighting that a relatively new and increasingly active ransomware gang was attacking their victims using several well-known (and patched) vulnerabilities.  In fact, one of their tactics focused on the target’s backup solution to compromise and disable the backups so they would be unable to recover once the gang initiated their attack.  This involved using a Veeam exploit well over a year old (CVE-2023-27532, published in March 2023) which affected all versions of Veeam’s flagship Backup & Replication product.  To Veeam’s credit, they were very quick to release hotfixes for customers to apply and remedy the flaw.  They also incorporated the patch into all subsequent builds for supported software versions so new installs would not be vulnerable to the same issue.

However, the ransomware gang knew that not every Veeam customer would have actually applied those fixes and hence went hunting for that flaw - and appeared to have been successful in finding many unpatched Veeam instances ripe for attack.

Yes, the vendor fixed the problem, but many customers were still sitting exposed and vulnerable to attack.

The SaaS-y Security Solution

This was a perfect example of a very real problem for any customers running "build-your-own" set-ups where they have to deploy, scale, maintain, update, patch, and refresh their backup software and infrastructure.  Regardless of if the security flaw or CVE has been fixed by the vendor, the onus is still on the customer to apply those fixes to their environment and ensure they themselves are not exposed.

Unfortunately, the reality is that many customers are either unaware, unable, or unwilling to get these fixes applied which leaves them vulnerable.  Attackers know this and are betting on the odds of finding those victims

So, how is Druva different?  Well, since Druva is 100% SaaS-driven, there is no software for the customer to have to patch.  Druva manages and maintains the entire stack so that if we find a flaw and fix it on our end, it is fixed for ALL of our customers.  There is no responsibility resting on the customer to make sure their specific Druva instance is patched and secure - we do that for them.  This eliminates the risk of Druva customers sitting exposed since a fix for one is a fix for all.

Imagine, not having to worry about these emergency hotfix situations to keep your backups safe.  Well, that’s why we call ourselves the Druva Security Cloud – it’s our job to ensure that our software is secure so that you don’t have to.  That’s our commitment to you: Data security on autopilot.

Currently, comparing legacy “do it yourself” backup solutions to fully managed SaaS data security solutions like Druva? Read the solution brief to see how Druva stacks up vs. the competition and ensure you have considered everything.