Ransomware operators increasingly delete backups before encrypting — new wave hits logistics sector
·RansomwareCritical
A cluster of ransomware incidents across European logistics companies showed a consistent pattern: attackers spent 3 to 7 days enumerating and wiping backup systems before triggering encryption, leaving victims with no recovery path.
Deception angle
A decoy NAS or backup server in the same subnet as real backup infrastructure catches exactly this enumeration. The attacker hits the decoy first, you disconnect the source machine, and the real backups remain intact.
Read about Kandaro Deception, or browse more security news.