All organizations have become more vigilant in detecting and rooting out ransomware in their IT environments. However, increasing perimeter cybersecurity defenses has resulted in hackers creating ransomware strains that are even more difficult to detect. To uncover these more elusive strains, more data protection solutions now include anomaly detection to help identify them.
Targeted Ransomware Attacks
Mounting a viable cybersecurity defense requires organizations to go beyond deploying firewalls and antivirus software. Hackers often research an organization before initiating a targeted ransomware attack.
By researching an organization, hackers may obtain specific information about it, such as its employees, IT infrastructure, and technologies used. Equipped with this information, they can develop ransomware that increases the probability of a successful attack.
Here are some hypothetical yet realistic ways hackers may use gathered information to develop ransomware specific to an organization:
- Knowing the email system used allows hackers to exploit known vulnerabilities to enter the organization.
- Once inside, knowing who works at an organization permits ransomware to attempt access to applications using their credentials.
- Understanding the technologies an organization uses enables ransomware to target specific application vulnerabilities and login credentials.
Hackers take time to research specific organizations because, if successful, they often demand ransoms of more than $1 million from large organizations. This has resulted in ransomware victims paying out more than $1 billion in 2023, with 2024 on pace to exceed this amount.
Adding insult to injury, organizations receive no guarantees paying the ransom will achieve the desired results. The decryption key provided may not work, or the hacker may still release or sell the stolen data. In either case, ransomware incurs substantial, unexpected costs without ensuring a successful resolution.
Intermittent Encryption
Knowing that hackers develop ransomware specific to their organization represents only part of the threat. Hackers know that organizations can detect and recover from ransomware that deletes or encrypts all production data. This has prompted hackers to make ransomware more difficult to detect.
Some ransomware strains employ an algorithm that encrypts data at a very granular level. Known as intermittent encryption, it does not encrypt entire files. Instead, it only encrypts components of a file as small as 16 bytes.
This technique has the same net effect as encrypting an entire file, making it unreadable and unusable. However, intermittent encryption incurs less system overhead since it only encrypts small chunks of each file. In doing so, intermittent encryption may evade common methods used to detect ransomware.
These evolving attack methods have decreased the effectiveness of perimeter cybersecurity solutions in detecting ransomware. This puts the onus on organizations to identify solutions that can help detect these customized, harder-to-find ransomware strains.
Anomaly Detection’s Emergence in Data Protection Solutions
To identify customized ransomware strains, a new generation of data protection solutions has emerged that includes anomaly detection. The rise of anomaly detection in data protection stems from its ability to perform historical data analysis.
Perimeter cybersecurity solutions primarily analyze production data in real time. While they can theoretically monitor and regularly scan all production data, this approach is problematic. Scanning incurs significant overhead on production systems and may fail to detect ransomware customized for specific organizations.
By contrast, using a data protection solution to routinely monitor and scan backup data is more effective. Moving scanning to the backup environment shifts the overhead to nonproduction systems. Since data protection solutions often sit idle during off-backup hours, organizations can use those resources to scan for ransomware.
The nature of these new ransomware strains makes it more effective to look for data anomalies over time. Some strains may only affect a specific organization or alter small chunks of data. Detecting these subtle changes may take days, weeks, or months. This suggests that data protection solutions with anomaly detection are better suited to identify them.
The Nature of an Anomalous Event
Using anomaly detection in data protection solutions, such as backup software and backup targets, may seem intuitive. Every organization wants to be alerted quickly to ransomware. However, determining the nature of each anomalous event can be complex.
Organizations may assume that if a data protection solution identifies an anomaly, it must have detected ransomware. However, this one-to-one relationship does not always hold true.
The detection of an anomaly may indicate ransomware in an organization’s IT environment. However, it may just as likely result from an unusual but acceptable business event. Changes to production data that are unrelated to ransomware can trigger anomaly detection.
Examples of such business-related anomalies include:
- Increased application usage, resulting in higher data change rates.
- Corporate acquisitions, which alter data access and usage patterns.
- Data cleanup efforts, such as archiving or deleting infrequently accessed data.
- More frequent backups, leading to increased stored data.
- Moving data or applications between storage locations.
- Encrypting data to comply with new regulations.
- Retiring an application or project and archiving or deleting its data.
These and other events can cause anomaly detection systems to flag legitimate activities as suspicious.
This highlights the challenges of implementing anomaly detection—detecting anomalies does not automatically mean detecting ransomware. Organizations must carefully evaluate data protection solutions with anomaly detection to ensure they provide meaningful alerts.
Creating Proper Associations
Before deploying a data protection solution with anomaly detection, organizations should look for solutions that can create proper associations between anomalies and real threats.
Ideally, the solution should have time to learn an organization’s typical data access and usage patterns. Normal activity in one organization may appear anomalous in another, and vice versa. More importantly, this learning period helps it differentiate between anomalies caused by routine business activities and those indicating ransomware.
This learning period also minimizes false positives. If a solution generates too many false alarms, organizations may start ignoring alerts, reducing the system’s effects.
Conversely, detecting few or no anomalies creates a different risk. Organizations may assume their environment is secure when, in reality, the anomaly detection system is ineffective.
Effective Anomaly Detection and Alerting Requires Generative AI
To be truly effective, a data protection solution with anomaly detection must perform two critical tasks:
- Monitor and analyze the behavior of both applications and users accessing data.
- Determine whether an anomaly is business-related or indicative of suspicious activity.
Because distinguishing between these two types of events is difficult, organizations should be skeptical of solutions that rely solely on preprogrammed, nonconfigurable anomaly detection capabilities.
To more accurately differentiate between business-related and suspicious anomalies, organizations should look for data protection solutions with generative artificial intelligence (AI) capabilities.
Generative AI enables a data protection solution to learn an organization’s IT environment, analyze backup data, track changes over time, and distinguish between routine business anomalies and potential ransomware threats.
