Ransomware attacks are a serious issue. According to the Sophos State of Ransomware Report 2024, 59% of organizations were hit with a ransomware attack in the last year. While some companies choose to pay the ransom, one in three organizations we surveyed were unable to recover their data even after paying.
The financial cost of paying a ransom isn’t the only cost companies suffer within the aftermath of an attack. Ransomware can also cripple the sales and operations of a company, so organizations must prepare by implementing strong cybersecurity measures, a comprehensive backup strategy, and a powerful incident response plan. These plans must be tested regularly to ensure backups are complete and usable, and that your incident response plan can be implemented quickly.
Learn more about ransomware best practices and how to protect your organization.
What is Ransomware Recovery?
Ransomware is one of the biggest threats facing organizations today. According to the 2023 Data Protection Trends report, the number of companies successfully attacked increased from 76% in 2021 to 85% in 2022. Ransomware attacks are also becoming increasingly sophisticated. Veeam’s 2024 State of Ransomware Report indicates that 96% of ransomware attacks targeted backup repositories, and 43% of affected data was unrecoverable.
A ransomware attack encrypts data, and some attacks lock users out of their systems and encrypt either whole drives or common locations where data is stored to extort substantial sums of money. However, exfiltration is usually combined with ransomware, and after stealing data, threat actors often threaten to leak private information unless victims pay a ransom.
Ransomware recovery is a set of actions organizations take to mitigate the impact of ransomware attacks. While following ransomware prevention best practices is always advisable, it’s still wise to have a response playbook in place. As a preemptive measure, organizations should implement immutable data backups and configuration snapshots that allow them to rebuild their systems.
Successful ransomware recovery depends on the effectiveness of an organization’s backup and data protection processes and what was affected during the attack.
Can You Undo Ransomware?
Ransomware attacks can vary in their severity and effectivness. Some ransomware attacks can be addressed by finding and removing the malware that encrypted data and then decrypting or recovering from backups without paying the ransom. However, there are cases where recovery is not possible, or worse, re-infection happens. It’s also important to highlight that threat actors often use sophisticated encryption methods that are difficult to reverse without having the required keys.
It is recommended and safer to plan for an attack and take steps to allow your organization to be ready to respond and recover data from backups. Think of ransomware defense as being similar to business continuity planning for a datacenter fire or major outage. After all, a successful attack could cause significant data loss and make your business inoperable. Preparation for a ransomware attack requires a comprehensive recovery plan. This plan should be regularly reviewed and thoroughly tested. It should also incorporate ransomware prevention best practices, including strong cybersecurity measures and a comprehensive backup strategy.
Best Practices for Ransomware Recovery
Ransomware protection and recovery go hand in hand. By following ransomware protection best practices at all times, you can reduce the likelihood of needing to implement your ransomware response plan.
Some key considerations include:
Implement Strong Cybersecurity Measures
The first step in any ransomware protection strategy is to harden your network against unauthorized access. Ideally, you should implement:
- Application security: Protect software applications from vulnerabilities, attacks, and data breaches.
- Endpoint security: Secure endpoints such as laptops, desktops, mobile devices, and servers from malicious activity.
- Network security: Safeguard computer networks from unauthorized access, use, or disruption.
- API security: Protect Application Programming Interfaces (APIs) from attacks, data breaches, and unauthorized access.
- Cloud security: Ensure security and compliance for cloud-based infrastructure, applications, and data.
- Data security: Protect data from unauthorized access, theft, corruption, or loss. Implement backup and recovery platforms and strategies to protect your data
- Identity and access management (IAM) security: Manage user identities, authentication, and access control.
- Email security: Protect email communications from spam, phishing, malware, and data loss.
- Supply chain security: Manage risks associated with third-party vendors, suppliers, and partners.
- Compliance security: Ensure adherence to regulatory requirements, standards, and policies.
Create a Comprehensive Backup Strategy
Create a secure and comprehensive backup strategy while considering these points:
- 3-2-1-1-0 Rule: An evolution of the original 3-2-1 backup plan, this system calls for three backups in addition to your original data. You should keep your backups on at least two different types of media, with one copy off-site and another offline. Also consider having one air-gapped copy that’s physically disconnected from the network, and do not tolerate any errors during backup and recovery
- Backup type: Your backup strategy can include full, incremental, or differential backups. Typically, full backups are performed weekly and incremental or differential backups are done daily. While an incremental backup stores all changes since the last full or incremental backup, a differential backup backs up all changes since the last full backup, and its size increases with each differential backup.
- Off-site and cloud-based backups: At least one set of backups should be off-site, either on a secure remote server or in cloud storage.
- Immutable backups: Backups should be immutable to prevent accidental or malicious deletion/changes. Immutable means that backup copies cannot be modified, deleted, or altered in any way once created. They ensure data integrity, security, and compliance.
Monitor Your Systems for Infection or Intrusion
Early detection of malware infection is crucial and can prevent a full-blown ransomware attack. By detecting a malware infection quickly, you’re in a better position to isolate the affected environments and limit the damage the attackers can do.
Use security information and event management (SIEM) solutions along with hardware and network monitoring tools to alert yourself to unusual activity that may be indicative of a malware infection.
Responding to Ransomware Attacks
If you suspect your systems have been infected with malware or there’s suspicious activity in your network, systems, or applications, take action immediately. The quicker your response, the better, especially if you can act during dwell time before the threat actor launches an attack to encrypt and/or exfiltrate your data.
If your organization suffers a ransomware attack. Here are five steps you can take to respond:
- Implement your incident response plan: Immediately activate your ransomware containment, isolation, and response plan and notify senior management and all responders.
- Engage with cybersecurity expert external support: Contact a ransomware incident response expert, such as Veeam and Coveware by Veeam, for expert advice for all stages from assessment to negotiation and recovery.
- Isolate and contain infected systems: Determine which systems are infected and isolate them from your internal network and the internet. Take snapshots and system images of all your infected
- Notify relevant authorities and law enforcement: Depending on your jurisdiction, you may be required to report the attack to regulatory authorities and law enforcement agencies, such as the FBI or CISA.
- Evaluate operational, legal and ethical considerations: Determine and inform all affected parties. Establish the operational and legal consequences of the breach, and consider data protection regulations, privacy laws, and your ethical responsibilities.
Ransomware Recovery Strategies
If your organization suffers a ransomware attack, you’ll have to weigh your recovery options carefully.
Your recovery strategy can be influenced by several factors, including:
- The time it will take to recover
- Operational impact to the business
- Financial impact
- Threats to release confidential data unless a ransom is paid
- Effect on customers or end users (i.e., patients and minors)
- Availability of clean backups
Below, we explore several response options, including using backups, paying the ransom, employing ransomware decryption tools, and ransomware service providers.
Restore Data From Veeam Backups
- Data restoration: Restoring data from Veeam backups is a relatively straightforward process. You have a choice between restoring to your original servers or restoring to a VM. This second option means you can recover quickly from a ransomware attack while your IT team works to clean up and reinstall your servers. Veeam also supports the creation of VM replicas that can failover in the event of a ransomware attack. Other recovery options include snapshots and flash-based repositories.
Veeam Data Platform offers a variety of restoration options to ensure data resilience and recovery across different environments. Here are some key options:
- VM recovery: This allows you to restore entire VMs to different data protection environments such as VMware vSphere, Hyper-V, and Amazon EC2.
- Disk recovery: You can recover and export disks from your backups.
- Item recovery: This includes the recovery of VM files, guest OS files and folders, and application items.
- File-level restore: Enables granular recovery of individual files and folders from backups.
- Cross-platform recovery: Supports recovery across multiple platforms including VMware, Hyper-V, AWS, Azure, and Google Cloud.
- Quick rollback: Allows for fast recovery by only restoring the changed blocks since the last backup.
- Cloud platforms: Provides comprehensive restore options for major public clouds, with specific steps for restoring Amazon EC2 instances and Microsoft Azure VMs.
- Orchestration at-scale and Veeam support: Large scale recoveries can be orchestrated for Veeam Data Platform Premium users.
Explore Paying the Ransom
The decision to pay the ransom is always difficult, and affected companies need to weigh the risks and consequences of paying it. While the FBI doesn’t support paying a ransom, the 2023 Ransomware Trends Report from Veeam shows that 80% of victims still decided to pay it. Reasons for negotiating with ransomware operators include:
- Encrypted backups: You may not have access to clean backups. According to our 2024 report, backup repositories are targeted in 96% of attacks.
- Opportunity cost: You lose money and credibility every day your company is out of action. The total restoration costs could be greater than paying the ransom.
- Confidential data: The threat to release damaging and confidential data is real, and you may feel it’s safer to pay the ransom.
However, there’s ample evidence to suggest that paying the ransom isn’t the end of the story. Even if a company pays the ransom, it still may not be able to recover all data. In addition, 80% of companies that paid the ransom were hit by a second ransomware attack later on.
Companies should investigate options that eliminate any possible need to pay the ransom.
What to Do After a Ransomware Attack
Document everything that happens during the attack, and once you’ve recovered, conduct a detailed postmortem examination. Follow these tips when preparing your postmortem examination:
- Assess the impact and extent of the ransomware attack: Conduct a post-recovery evaluation. Determine the full extent of the attack and measure its impact in terms of downtime and financial losses. Identify how the hackers gained access and establish if they succeeded in compromising your backups.
- Address vulnerabilities: Identify and fix all hardware and software vulnerabilities, and provide security training to your employees.
- Strengthen security: Harden your systems and review permissions. Set up extra VPNs to better isolate systems and implement multi-factor authentication (MFA) practices.
- Implement long-term risk mitigation strategies: Link up with cybersecurity organizations, such as NIST and CISA, for advice on ransomware prevention.
How Long Does a Ransomware Recovery Take?
The length of time it takes to recover from a ransomware attack varies, depending on the size of the organization and the severity of the attack. A recent Statista survey into ransomware downtime periods found it takes an average of 24 days to recover after a ransomware infection. However, Hewlett Packard Enterprise (HPE) cites a much longer recovery period of six weeks.
Conclusion
A ransomware infection doesn’t have to cause havoc for your business. With proper security measures and an effective backup strategy, you can protect your data, making it easier to recover from an infection. Try to avoid paying the ransom whenever possible, as not only does the FBI advise against doing this, but there’s no guarantee that paying will actually restore access to your data.
You have a better chance of recovery from a ransomware attack if you have a response plan in place, detect the attack early, and train your team in ransomware mitigation. It’s also essential to have a backup strategy in place with off-site, immutable copies of your data. Be sure to review your security, disaster recovery (DR), and backup strategies regularly to ensure you’re properly protected from ever-evolving threats.
Find out more about Building a Cyber-Resilient Data Recovery Strategy by downloading our dedicated whitepaper.