3 ms·
What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly
by TedDoesntTalk 5y ago
What if the ransomware infiltrated 3 months ago but was not activated until now? Restoring a 3-month old backup is not useful if the data changes significantly each day.
- hulitu 5y agoI don't think the bad guys wait 3 months. Time is money. They have no advantage in waiting.
- scohesc 5y agoOn the contrary - If you have an incremental backup that goes as far back as say 14 days for example. No separate archived snapshots, etc. If you infiltrate the network and figure out this crucial bit of info - you just wait 14 days while you branch out and infect more PCs, more of the network. Once 14 days goes by, it's guaranteed that any data the victim tries to restore from is corrupted or potentially encrypted with ransomware.
- PeterisP 5y agoI believe that forensics of major attacks does show that usually the bad guys have been in the network for weeks before triggering the ransomware, and it rarely happens on the same day as the initial attack. The expectation is that they will first spend the time and effort to look at your network to find out your backup process, and do/wait as much as is necessary to circumvent, disable or destroy your backups if it can be easily done.