Time is of the essence

Issue 8 2023 Information Security

Ransomware attacks do not happen instantly. It is not one malicious link and then lockdown. Instead, attacks can be years in the making, from initial observations and break-ins to declaring the ransom. For example, reports suggest Clop may have been sitting on its MOVEit exploit as far back as 2021. So, what is the timeline of a ransomware attack, and why must businesses understand this to improve their ransomware resilience?

Understanding the attack timeline

It is a common misconception that ransomware attacks happen out of the blue. Cybercriminals often like to take their time, taking the scenic route through your business and getting to know it inside out.

The ransom stage is the only part of the process that is visible. This is when attackers announce their presence, but as highlighted by investigations into this year’s MOVEIt hack (the biggest hack of 2023 so far), they can spend years behind the scenes. So, what is happening in the lead-up to the ransom demand?

First, attackers start with an observation stage. This time is spent gathering as much information as possible on the target organisation, including its people, processes, and technology. This could take months. After enough intel has been gathered, attackers will move to infiltrate their target’s system, gaining access through a preliminary attack, commonly a phishing email.

After establishing entry, attackers will set up camp within the organisation’s IT infrastructure, creating a base of operations from which they can elevate their access and make lateral movements. At this stage, they do some of the most significant damage, snooping around undetected and compromising identified high-value targets. They can take their time over this, making as many moves as possible to ensure maximum exploitation.

After this, attackers spend time crippling recoverability. This involves altering backup routines, documentation, and security systems to reduce or completely deny restore capabilities. So, before the organisation is even aware of the attack, it is too late to turn to its backup. Things are heating up at this stage, finally coming to a head with the declaration of ransom. As well as announcing their presence and making demands, cybercriminals at this final stage will encrypt their victim’s data and wipe all records and backups. This entire process might unfold over a year or even multiple years.

Making your backup bulletproof

The discovery that malicious actors can inhabit your systems unseen for a year or more while you are none the wiser can be daunting for businesses. But it is crucial knowledge and never fails to create a sense of urgency when implementing a robust data security strategy. Every minute your business passes without this in place is another minute cybercriminals can carry out the groundwork that will later cause much pain.

So, armed with this knowledge, what steps do businesses need to take? The biggest concern is the usability of backups for recovery after an attack. Suppose your system was breached a year ago without your knowledge. In that case, there is a very high likelihood that your backups are impacted, meaning you will try to restore your data using a compromised backup. Fortunately, this can be avoided with the proper preparation and the right backup strategy in place.

Getting hit by a ransomware attack is almost inevitable for the modern enterprise, with 85% of organisations experiencing at least one cyber-attack in 2022, nearly 10% more than the previous year. Moreover, as cybercriminals increasingly target backups, the road to recovery can be longer than ever.

Thinking of ransomware attacks as a case of ‘when’, not ‘if’, means recognising that you will need to use your backup to restore your critical data when the time comes. Acknowledging this should spur businesses to invest serious time and resources to ensure their backups are ironclad.

This is possible by following the golden rule of backup: 3-2-1-1-0. This requires three copies of data stored on two different media, one stored off-site and one air-gapped and immutable. Across these copies, there needs to be zero errors. Working under the assumption that cybercriminals will target your backup means taking precautions so you retain at least one untouched copy to use for your recovery. It is like keeping your money in a bank and making copies of essential documents in case your house gets robbed – thieves will target your safe, so storing valuables offsite and making copies provides peace of mind.

Implementing a 3-2-1-1-0 backup strategy isn’t a one-time thing. You must constantly monitor and test your backups, checking for errors and cleaning your data as needed. Cybercriminals rely on businesses not doing this; you can stay one step ahead by remaining strict on your data strategy.

Controlling the chaos

Ransomware is a disaster, and disaster recovery takes time. According to the latest Veeam Ransomware Trends Report, most businesses take at least three weeks to recover from a ransomware attack. It is important to note that this recovery time starts after the company has triaged. This investigative stage can be extensive, and its impact on recovery timelines is hard to predict and overstate. At this stage, the business needs to identify the attack's source and the damage's extent; they may even face yellow tape if government bodies need to drive the investigation.

During this time, the business is still compromised. In the worst-case scenario, it might have been forced to cease operations entirely while the breach is investigated and resolved. It is not making money if it is not operating. Worse than this, costs are spiralling as it is resource-intensive to recover from a large-scale attack, with IT departments and key stakeholders working round the clock, and there are legal fees and compensation costs to account for, as well as reputational damage.

It is hard to predict how long a recovery process will take because ransomware is a disaster with a difference. Suppose you are recovering from a natural disaster like a fire. In that case, you can trust your last known backups or replicas and use them to begin recovery immediately, safely knowing that the backups have not been interfered with. This is not the case with a cyber-disaster, which considerably lengthens recovery time. It takes time to identify which servers are infected and to determine whether backups and replicas are also affected (if they are, they can reintroduce the ransomware to your infrastructure, sending you right back to square one).

However, while ransomware is a severe threat and can potentially cause widespread damage, there are measures businesses can take to reduce the recovery time and the extent to which they can be compromised. As mentioned, the golden 3-2-1-1-0 backup rule is a critical tool in your arsenal. While ransomware attacks are inevitable and backups increasingly targeted, by implementing a robust data backup strategy, you always have a clean copy of your data to fall back on.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Empower individuals to control their biometric data
Information Security Access Control & Identity Management Security Services & Risk Management
What if your biometrics, now embedded in devices, workplaces, and airports, promising seamless access and enhanced security, was your greatest vulnerability in a cyberattack? Cybercriminals are focusing on knowing where biometric data is stored.

Read more...
Strategies for combating insider threats
Information Security Security Services & Risk Management
In Africa, insider threats pose an increasingly significant risk to businesses, driven by economic uncertainty, labour disputes, and rapid digital transformation. These threats can arise from various sources, including disgruntled employees and compromised third-party service providers

Read more...
Five tech trends shaping business in 2025
Information Security Infrastructure
From runaway IT costs to the urgent need for comprehensive AI strategies that drive sustainable business impact, executives must be prepared to navigate a complex and evolving technology environment to extract maximum value from their investments.

Read more...
Kaspersky’s predictions for 2025 APT landscape
Information Security
The 2025 advanced persistent threat (APT) includes the rise of hacktivist alliances, increased use of AI-powered tools by state-affiliated actors – often with embedded backdoor – more supply chain attacks on open-source projects.

Read more...
SecurityHQ certified B-BBEE Level 1: Delivering global services from a local entity
SecurityHQ Information Security
SecurityHQ, a global managed security services provider (MSSP) with an office in South Africa, has announced it can now offer local companies a complete managed cybersecurity service from a Level-1 B-BBEE accredited and 51% black-owned service provider.

Read more...
2024, the year of Fraud-as-a-Service
Information Security
A report from AU10TIX outlines how ‘the industry’s dark engine’ offers user-friendly fraud kits that enable amateurs to execute complex attacks against thousands of accounts in minutes.

Read more...
The future of endpoint security
Information Security
Endpoint security is a critical pillar of cybersecurity, especially for South African businesses, which are becoming prime targets for cybercriminals. Endpoint security involves safeguarding devices connected to a network from a range of cyberthreats.

Read more...
Not enough businesses take cybercrime seriously
Information Security
Interpol recently revealed that cybercrime, specifically ransomware incidents, cost the South African economy up to 1% of the country’s GDP, while the Council for Scientific and Industrial Research estimated the loss at R2,2 billion a year.

Read more...
Navigating today’s cloud security challenges
Information Security Infrastructure
While the cloud certainly enables enterprises to quickly adapt to today’s evolving demands, it also introduces unique challenges that security teams must recognise and manage. Vincent Hwang offers insights from the 2025 State of Cloud Security Report.

Read more...