The Importance of Secure Backup Is Proven Again: Bad Rabbit Ransomware Encrypts Backup Files

Acronis Cyber Protect Cloud
for service providers

As we already reported, a new ransomware outbreak occurred in Europe on October 24. It hit some companies in Russia, Ukraine, Germany and the U.S., preventing full operations for some companies even after two days. Bad Rabbit has numerous advanced features such as propagating over local networks, but most notably it’s actually attacking backup files.  

Acronis
Ransomware attacks backup files

We’ve been reporting on this trend for a long time already: as users increasingly rely on backup, almost every new ransomware tries to delete or encrypt backup files – and Bad Rabbit is no exception. As you can see on a screenshot above, among other files it targets Acronis Backup files (*.tib).

Too bad for cybercriminals that, starting with our Acronis True Image 2017 New Generation product, we’ve been providing robust, multilayered data protection through our Active Protection technology. In fact, Bad Rabbit illustrates the effectiveness of our proactive technology. Active Protection doesn’t need updates, an internet connection, or complex, preset rules to detect, stop and revert changes made by ransomware. We can proudly say that Acronis delivers the most secure backup in the world by providing the only solution combining active and passive data protection approaches.

How Active Protection deals with Bad Rabbit and all ransomware attempts

Let’s look how Active Protection cripples Bad Rabbit from doing anything bad, step-by-step.  

Acronis
Acronis Detects Bad Rabbit Ransomware

First of all, Acronis Active Protection detects malicious DDL runs via rundll32. The user is prompted to block the malicious process and Active Protection automatically reverts any unauthorized changes. It only takes a few seconds to get all your files back.

If ransomware tries to change Master Boot Record (MBR) of your hard drive, Active Protection detects and stops this as well.  

Acronis
Acronis protects MBR from ransomware

Finally, when Bad Rabbit or any other ransomware tries to encrypt backup files, those attacks are easily prevented thanks to robust self-protection technologies that are part of Acronis Active Protection.  

Acronis
Acronis Active Protection stops Bad Rabbit

The self-protection functionally was independently tested earlier this year by Anti-malware-test.com’s laboratory and was proven being very efficient, while most of other backup solutions offered nearly no self-protection capabilities.  

Acronis
Acronis Active Protection tests

Secure backup that can combat ransomware is a must

Think about it: If your anti-malware protection fails and your backup is encrypted by ransomware, your data will be lost forever.

That is why it’s important to choose a secure backup solution that:

  • Includes proactive anti-ransomware technologies like Acronis Active Protection.
  • Delivers multi-layered protection that works during all three stages of potential attack: proactive-active-reactive.
  • Offers robust self-protection capabilities that prevents malware from compromising backup files, either locally or in the cloud.
  • Is fast, since a slow recovery means lost time and money. Acronis technologies were independently tested as well and proven to be faster than competition.

Acronis secure backup solutions:

Acronis
Author
Alexander Ivanyuk
Senior Director, Technology
Alexander joined Acronis in 2016 as Global Director, Product and Technology Positioning. At this role Alexander is directly involved into all product launches in terms of messaging, go-to-market strategy and overall positioning including partner relations.

About Acronis

A Swiss company founded in Singapore in 2003, Acronis has 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect Cloud is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses.