Akira Ransomware: A Threat to Backups

Summary

The Finnish National Cyber Security Centre (NCSC-FI) warns of escalating Akira ransomware attacks targeting backup systems. These attacks exploit a Cisco VPN vulnerability and focus on wiping NAS and tape backups, severely hindering recovery efforts. Organizations must prioritize robust backup strategies, including offsite and offline copies, to mitigate this growing threat.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Okay, so you’ve probably heard the news: ransomware is still a HUGE problem, right? It feels like every other day there’s a new strain popping up, each one more aggressive than the last. And right now, Akira ransomware is making headlines, especially in Finland. The Finnish National Cyber Security Centre (NCSC-FI) is raising alarms because Akira isn’t just encrypting data; it’s going after backups too. Seriously, they are wiping out NAS devices and even tape backups – those last-ditch lifelines we all depend on. So this really highlights, the need to really have your backup and recovery strategy in tip-top shape.

Why Akira is Such a Pain

What makes Akira so dangerous? Well, it’s exploiting a vulnerability (CVE-2023-20269) in Cisco’s ASA and Firepower FTD products. Basically, if you aren’t using multi-factor authentication (MFA), they can waltz right in. Think of it like leaving your front door unlocked – and trust me, I had a situation at my last company where that nearly happened. I forgot to set up MFA after a system update, and luckily our security team caught it. Anyway, once Akira’s in your system, its priority number one is finding and deleting your backup data. By doing this, they are really twisting the knife. Without backups, how are you going to recover your data without paying? They know this, and they’re counting on it.

Time to Level Up Your Backup Game

Look, traditional backups are great and all, but they just aren’t cutting it anymore against these kinds of threats. We need a more robust approach. Here are some key things to keep in mind:

• The 3-2-1-1 Backup Rule: You’ve probably heard of the 3-2-1 rule. Well, this takes it a step further. Keep at least three copies of your data on two different storage mediums, with one copy offsite and, crucially, one copy offline – like an air-gapped drive that isn’t constantly connected to your network.

• Test, Test, Test: Seriously, I can’t stress this enough. How often do you actually test your backups? You need to make sure you can actually recover your data. It’s no good having a backup if it’s corrupted or you can’t restore it when you need it most.

• MFA Everywhere: I know it can be a pain, but seriously, implement multi-factor authentication wherever you can. It’s an extra layer of security that can make all the difference.

• Patch, Patch, Patch: Keep your systems updated! Those security patches are there for a reason. They’re like digital vaccines, protecting you from known vulnerabilities.

• Train Your People: You know, phishing emails are still one of the biggest ways attackers get in. Make sure your employees know how to spot them and what to do if they see something suspicious. It doesn’t matter how good your tech is, if someone clicks a bad link, you’re in trouble.

Thinking Outside the Box: New Technologies

And because the bad guys aren’t slowing down, we can’t either. Here are a few emerging technologies to keep an eye on:

• Immutable Backups: These backups can’t be changed or deleted, even by ransomware. They’re like fortresses for your data.

• Cloud-Based Backups: Store your backups in the cloud for offsite protection. Plus, you can often integrate these with your on-premises systems for a hybrid approach.

• Backup Appliances: Dedicated devices that make backup and recovery easier, and often come with built-in security features.

• Data Replication: This replicates your data in real-time to a secondary location, meaning minimal data loss and super-fast recovery.

Ultimately, the rise of ransomware like Akira is a wake-up call. We need to be proactive about our data protection. A multi-layered approach combining best practices with new technologies is really the way to go. The goal? Ensuring business continuity. With the right strategies and some smart tech investments, you can really improve your resilience and keep those cyber threats at bay.