Ransomware's latest twist: No backups, no salvation | DigitalShield

A new group of cybercriminals identified as n0n i s revolutionizing the usual tactics of digital extortion by threatening to encrypt or directly delete the backup infrastructure, as well as the shadow copies of their victims .

This strategy aims to undermine the fundamental pillar on which most companies rely for recovery from ransomware attacks: the idea that having a backup is enough to avoid paying a ransom.

The group was first detected on September 18 by researchers from the cybersecurity firm CyberXTron. In just four days, the group's leak platform on the dark web had already accumulated more than a dozen affected organizations, a list that has continued to grow.

Entities in the financial sector account for nearly a quarter of the confirmed victims, followed by technology firms, retail businesses, and educational institutions. Although the U.S. is the group's main target, incidents have also been reported in countries such as Sweden, Brazil, Vietnam, and Luxembourg.

Despite how aggressive the threat from n0n may be, analysts emphasize that there is currently no technical evidence that the group possesses a code capable of executing the massive destruction of backups it promises.

As Jason Vanzin, a specialist from the consultancy Right Hand Technology Group, points out, the real value of this strategy lies in the psychological pressure on the victim.

"Most ransomware recovery plans are based on the assumption that backups are untouchable. A group that specifically threatens that assumption doesn't need its capability to be real; it just needs the victim to believe it could be," he .

This new threat actor does not use complex vulnerabilities or novel tools. The group gains its initial access through credentials previously stolen by infostealer-type malware .

Once inside the system, they escalate privileges to obtain administrative rights, extract confidential data for extortion, and finally include the explicit threat to the backups in the ransom note .

Although this may seem like a new way of proceeding by ransomware groups, the truth is that this technique has been applied previously by other cybercriminals . In fact, it has led storage providers to promote the use of immutable copies, on tape or through completely isolated duplicates.

What to do to prevent

To address this threat and reduce the risk of intrusion, Vanzin — based on the guidelines from the firm CyberXTron — suggests that organizations s hould urgently prioritize credential hygiene by using unique passwords, activating two-factor authentication, and constantly monitoring for infostealer-type malware .

He also emphasizes the importance of monitoring any unusual privilege escalation on the network to intercept attackers before they manage to take control of administrative tools or begin extracting confidential information.

On the other hand, he assures that real isolation of backups is advisable, which should have independent authentication paths and, if possible, with immutable or offline storage inaccessible from the main system credentials.

The researcher concludes that it is useless to verify that backup processes have been successfully completed if a full restoration has never been tested, so it is essential to conduct regular recovery drills to confirm that the backups remain intact and available in case of emergency.

A new group of cybercriminals identified as n0n i s revolutionizing the usual tactics of digital extortion by threatening to encrypt or directly delete the backup infrastructure, as well as the shadow copies of their victims .

This strategy aims to undermine the fundamental pillar on which most companies rely for recovery from ransomware attacks: the idea that having a backup is enough to avoid paying a ransom.

The group was first detected on September 18 by researchers from the cybersecurity firm CyberXTron. In just four days, the group's leak platform on the dark web had already accumulated more than a dozen affected organizations, a list that has continued to grow.

Entities in the financial sector account for nearly a quarter of the confirmed victims, followed by technology firms, retail businesses, and educational institutions. Although the U.S. is the group's main target, incidents have also been reported in countries such as Sweden, Brazil, Vietnam, and Luxembourg.

Despite how aggressive the threat from n0n may be, analysts emphasize that there is currently no technical evidence that the group possesses a code capable of executing the massive destruction of backups it promises.

As Jason Vanzin, a specialist from the consultancy Right Hand Technology Group, points out, the real value of this strategy lies in the psychological pressure on the victim.

"Most ransomware recovery plans are based on the assumption that backups are untouchable. A group that specifically threatens that assumption doesn't need its capability to be real; it just needs the victim to believe it could be," he .

This new threat actor does not use complex vulnerabilities or novel tools. The group gains its initial access through credentials previously stolen by infostealer-type malware .

Once inside the system, they escalate privileges to obtain administrative rights, extract confidential data for extortion, and finally include the explicit threat to the backups in the ransom note .

Although this may seem like a new way of proceeding by ransomware groups, the truth is that this technique has been applied previously by other cybercriminals . In fact, it has led storage providers to promote the use of immutable copies, on tape or through completely isolated duplicates.

What to do to prevent

To address this threat and reduce the risk of intrusion, Vanzin — based on the guidelines from the firm CyberXTron — suggests that organizations s hould urgently prioritize credential hygiene by using unique passwords, activating two-factor authentication, and constantly monitoring for infostealer-type malware .

He also emphasizes the importance of monitoring any unusual privilege escalation on the network to intercept attackers before they manage to take control of administrative tools or begin extracting confidential information.

On the other hand, he assures that real isolation of backups is advisable, which should have independent authentication paths and, if possible, with immutable or offline storage inaccessible from the main system credentials.

The researcher concludes that it is useless to verify that backup processes have been successfully completed if a full restoration has never been tested, so it is essential to conduct regular recovery drills to confirm that the backups remain intact and available in case of emergency.

Become a premium member for free!