Is your most recent backup safe to restore after an attack?

Why newest is a trap

The value of a recent backup is low data loss. The danger of a recent backup, after a cyberattack, is that it faithfully captured the compromise. Because of dwell time, the days or weeks an intruder spends inside before detonating, the newest points are the most likely to include the attacker, not the least. Restoring them can bring the ransomware back to life or restore the persistence the attacker set up.

What could be hiding in it

• Encrypted or partially encrypted files from an attack already in progress when the backup ran.
• Dormant ransomware, loaders or remote-access tools waiting to execute.
• New or backdoor accounts and elevated privileges the attacker created.
• Security tooling that was quietly disabled, and logs that were cleared.
• Altered configuration and scheduled tasks that re-establish the foothold after restore.

How to tell before you trust it

You do not have to guess. The same signals that drive clean-point selection tell you whether a given point is safe:

1. Compare the backup time against the incident timeline. Does it predate the earliest indicator of compromise, or just the moment you noticed?
2. Check anomaly signals around that point: change-rate spikes, mass modifications, high-entropy writes.
3. Scan the point for malware and indicators of compromise.
4. Restore it into an isolated environment and watch it. Healthy and quiet is good. Beaconing or errors is your answer.

What to do instead

1. Preserve your copiesExtend retention and hold immutable and air-gapped copies so clean points do not age out during the incident.
2. Select a known-clean pointFind the newest point that predates the attacker and passes scanning, rather than the newest point overall.
3. Validate in isolationProve the point is clean and recoverable in an isolated environment before it touches production.
4. Recover in orderBring identity back first, then dependencies, then applications, each validated as you go.

How KELYN makes this operational

KELYN uses Commvault immutable and air-gapped copies plus anomaly and threat scanning to separate the newest point from the newest clean point, then validates the winner in an isolated recovery environment. The difference between those two points is often the difference between recovering and reinfecting.

Sources

• Commvault Cyber Recovery Readiness research with GigaOm ↗