As cited
Citation snapshot as of .
ransomware
Using Backup Utilities for Data Exfiltration | Huntress
Huntress researchers have identified ransomware affiliates using legitimate backup utilities to exfiltrate data during double extortion attacks, prior to encrypting files. The use of benign tools to stage data theft is a technique previously associated with Noberus/ALPHV ransomware operators.
Why it matters: Organizations using backup utilities may not flag their routine use as suspicious, making this approach effective for threat actors conducting data theft; practitioners should monitor backup tool usage for unauthorized data staging and transfers.
- Source published
- First seen by Cybersecurity Tracker