76% of organizations admit paying ransomware criminals

Businesses are losing the battle when it comes to defending against ransomware attacks, according to the Veeam® 2022 Ransomware Trends Report, which found that 72% of organizations had partial or complete attacks on their backup repositories, dramatically impacting the ability to recover data without paying the ransom. According to Veeam Software, 80% of successful attacks targeted known vulnerabilities, emphasizing the importance of software patching and upgrading. Almost all attackers tried to destroy backup repositories in order to prevent the victim from recovering without paying the ransom.

The Veeam 2022 Ransomware Trends Report is based on the findings of an independent research firm that surveyed 1,000 IT leaders whose organizations had been successfully attacked by ransomware at least once in the previous 12 months, making it one of the most comprehensive reports of its kind. The study is the first of its kind, and it looks at the key takeaways from these incidents, their impact on IT environments, and the steps taken to implement Modern Data Protection strategies that will ensure business continuity in the future. To understand cyber-preparedness alignment across organizations, the research project specifically surveyed four IT personas (CISOs, Security Professionals, Backup Administrators, and IT Operations).

“Ransomware has democratized data theft and requires a collaborative doubling down from organizations across every industry to maximize their ability to remediate and recover without paying the ransom,” said Danny Allan, CTO at Veeam. “Paying cybercriminals to restore data is not a data protection strategy. There is no guarantee of recovering data, the risks of reputational damage and loss of customer confidence are high, and most importantly, this feeds a self-fulfilling prophecy that rewards criminal activity.”

Paying the ransom is not a recovery strategy

The majority (76%) of cyber-victims paid the ransom to end an attack and recover data, according to the organizations polled. Unfortunately, while 52 percent paid the ransom and were able to recover data, 24% paid the ransom but were still unable to recover data, resulting in a one-in-three chance that paying the ransom results in no data recovery. It is worth noting that 19% of businesses did not pay the ransom because they were able to recover their own data. This is what the remaining 81% of cyber-victims must strive for: data recovery without paying the ransom.

“One of the hallmarks of a strong Modern Data Protection strategy is a commitment to a clear policy that the organization will never pay the ransom, but do everything in its power to prevent, remediate and recover from attacks,” added Allan. “Despite the pervasive and inevitable threat of ransomware, the narrative that businesses are helpless in the face of it is not an accurate one. Educate employees and ensure they practice impeccable digital hygiene; regularly conduct rigorous tests of your data protection solutions and protocols; and create detailed business continuity plans that prepare key stakeholders for worst-case scenarios.”

Prevention requires diligence from both IT and users

The “attack surface” for criminals is diverse. Cyber-villains most often first gained access to production environments through errant users clicking malicious links, visiting unsecure websites or engaging with phishing emails — again exposing the avoidable nature of many incidents. After having successfully gained access to the environment, there was very little difference in the infection rates between data center servers, remote office platforms and cloud-hosted servers. In most cases, the intruders took advantage of known vulnerabilities, including common operating systems and hypervisors, as well as NAS platforms and database servers, leaving no stone unturned and exploiting any unpatched or outdated software that they can find. It is notable that significantly higher infection rates were reported by Security Professionals and Backup Administrators, compared with IT Operations or CISOs, implying that “those closer to the problem see even more of the issues.”

Remediation starts with immutability

According to survey respondents, 94% of attackers attempted to destroy backup repositories, and in 72% of cases, this strategy was partially successful. The removal of an organization’s recovery lifeline is a popular attack strategy because it increases the likelihood that victims will be forced to pay the ransom. The only way to avoid this scenario is to have at least one immutable or air-gapped tier within the data protection framework, which 95% of those polled said they now have. Indeed, many organizations reported using immutability or air-gap media in more than one tier of their disk, cloud, and tape strategy.

Other key findings from the Veeam 2022 Ransomware Trends Report include:

• Orchestration matters: To proactively ensure recoverability of their systems, one in six (16%) IT teams automate the validation and recoverability of their backups to ensure their servers are restorable. Then, during remediation of a ransomware attack, 46% of respondents use an isolated “sandbox” or staging/test area to ensure their restored data is clean prior to reintroducing the systems into production.
• Organization alignment must unify: 81% believe their organizations’ cyber and business continuity/disaster recovery strategies are aligned. However, 52% of respondents believe the interactions between these teams requires improvement.
• Diversifying the repositories holds the key: Nearly all (95%) organizations have at least one immutable or air-gapped data protection tier, 74% use cloud repositories that offer immutability; 67% use on-premises disk repositories with immutability or locking; and 22% use tape that is air-gapped. Immutable or not, organizations noted that in addition to disk repositories, 45% of production data is still stored on tape and 62% goes into a cloud at some point in their data lifecycle.

“The Middle East is certainly not immune to cyberattacks. The opposite is in fact true. Our region is heavily target by sophisticated hackers. Organizations are beginning to realize that ransomware attacks are in fact the same as a full-scale disaster recovery scenario. This has helped them better plan and utilize features which Veeam provides like immutability of backups, ensuring a guaranteed recovery point,” commented Claude Schuck, Regional Director, Middle East at Veeam.