BDRaaS Briefing: Recovery That Does Not Need the Vendor
The theme this week, more by coincidence than design, is recovery that keeps working when the vendor is not there. Bacula Systems has packaged a recovery kit meant to be used with Bacula itself treated as unavailable. Cohesity has brought recovery orchestration and Active Directory forest recovery to disconnected deployments. NetApp is piloting a sovereign Keystone in Germany and France.
For anyone moving clients off VMware, MSP360 now restores straight into Hyper-V and Proxmox. MSP360 also turned up in this week’s threat reporting, for the wrong reasons.
Vendor releases
Bacula packages recovery that does not depend on Bacula
Bacula Systems, based in Switzerland, announced Bacula Independent Recovery on 30 September. It restores from physically isolated copies on tape, removable media or disconnected storage without a cloud connection, vendor portal, online licence check or Bacula’s own staff. Customers get a sealed Recovery Independence Kit holding the software, configuration, keys and procedures to rebuild the recovery environment, and the catalogue can be rebuilt from the media. There is no mandatory call-home.
The centrepiece is a witnessed test in which Bacula’s people and services are treated as unavailable and the customer recovers agreed systems on their own. Bacula positions it against NIS2 and DORA. No pricing or availability date.
The practical bit. Most air-gap conversations stop at “the data is offline”. The harder question is what else the restore needs: a licence server, an identity provider, a SaaS console, a support engineer. Ask that of whatever you sell, Bacula or not, and write the answer into the DR plan. A client in DORA scope will be asked it eventually.
Source: Bacula Systems announcement
Cohesity brings AD forest recovery to self-managed deployments
The self-managed version of Cohesity’s Helios control plane, the one customers can run inside their own air-gapped environment, gains RecoveryAgent orchestration for disconnected and sovereign sites. Active Directory Forest Recovery, powered by Semperis, is now built in, with Cohesity provisioning recovery VMs from Windows Server templates and tearing the clean room down after a drill. Sophos malware scanning is included in Enterprise Edition, and threat scans now reach FortKnox vault data. No pricing.
The practical bit. AD forest recovery is the part of most ransomware recoveries nobody has rehearsed, and usually why a two hour RTO becomes two days. An automated rebuild you can drill and throw away is worth testing before you promise it. Check the licensing: Cohesity lists RecoveryAgent or Enterprise Edition as a prerequisite.
MSP360 restores directly to Hyper-V and Proxmox
MSP360 Backup Agent 8.7.1 for Windows restores image-based backups directly to Hyper-V and Proxmox VE, and VMware and Hyper-V VM backups straight into Proxmox. Proxmox VMs and LXC containers can also be restored as VHD, VHDX or RAW disks. It only works with backups in MSP360’s new backup format. No pricing change was mentioned.
The practical bit. Cross-hypervisor restore is a migration tool as much as a DR feature. For a small client leaving VMware, restoring last night’s backup onto the new Proxmox host rehearses the migration and the DR plan at once. Check their jobs are on the new format first.
Source: MSP360
Arcserve ShadowControl 4.8 manages host-based Hyper-V protection
ShadowProtect 8.0 added host-based Hyper-V protection in June. ShadowControl 4.8, released in September, now manages it, with automatic VM enumeration and one dashboard for agent-based and host-based endpoints. It also moves email alerts for Gmail and Microsoft 365 to OAuth2, ahead of Basic Authentication being retired in December 2026.
The practical bit. The OAuth2 change is the bit to act on. Alerting that stops in December is how a failed backup goes unnoticed for a month. Upgrade and re-test notifications before then.
Source: Arcserve
As a service
NetApp pilots Keystone Sovereign in Germany and France
Keystone Sovereign is a version of NetApp’s storage-as-a-service subscription for qualified European customers. It promises European residency for customer data, logs, backups and telemetry, European support and escalation, European-controlled access and management, documented data flows, and contract terms to match. Pilots start in Germany and France, with more countries planned. No general availability date or pricing.
The practical bit. The list covers logs, telemetry and support access, not just where the data sits. That is the right checklist for any sovereign claim, including your own, and it is where a client’s second question will go.
Source: StorageNewsletter
Arrow adds PeaSoup storage and Veeam Cloud Connect to ArrowSphere in the UK
Arrow has added PeaSoup Cloud’s S3-compatible object storage and Veeam Cloud Connect services to ArrowSphere Cloud in the UK. Both run in PeaSoup’s UK data centres, certified to ISO 27001 and Cyber Essentials Plus, with Object Lock immutability, predictable monthly pricing and no ingress or egress fees.
The practical bit. A UK-hosted Cloud Connect target you provision and bill through the same marketplace as everything else makes offsite copies for small clients less effort. Compare the per-TB price with your current target, and get restore terms in writing.
Source: IT Europa
Who bought whom
Hosvara buys Dr. Backup
Hosvara, a holding company for MSP-focused businesses, has bought Dr. Backup, a cloud backup provider founded in 2002 that serves nearly 100 MSPs in the US and Canada. Terms were not disclosed. Founder Mitch Romm stays on as an adviser for a year, and partners keep the same platform and support team.
The practical bit. Small white-label backup providers are being consolidated. If one of yours is founder-run, check whether your contract survives a change of control on the same terms.
Source: Channel Insider
What is being exploited
Signed MSP360 RMM installer used in phishing to deploy ScreenConnect
Microsoft has reported phishing campaigns, first seen in July, that deliver a legitimate, signed MSP360 RMM v2.5.0.67 installer disguised as a Zoom setup file or an e-card. Once it is installed, the attackers use it to run PowerShell and add ScreenConnect as a second remote access channel. No vulnerability is involved.
The practical bit. A signed RMM agent is trusted by most endpoint tools. Alert on RMM installers that do not belong to you, and if a client’s machines run an RMM you do not manage, find out why.
Source: The Hacker News
Warlock ransomware turns to Spanish- and Portuguese-speaking targets
Symantec, which tracks the Warlock group as Longlegs, reports at least four victims in the past two months across Spanish- and Portuguese-speaking countries in Europe, Africa and Latin America: a water utility, a telecoms provider, a regional government body and a university. Initial access is through on-premises SharePoint flaws including the ToolShell chain. The group stages its payload in the domain’s SYSVOL share so AD replication carries it to every domain controller.
The practical bit. SYSVOL staging means restoring a domain controller can restore the payload with it. Make sure the AD recovery plan checks SYSVOL before trusting a restored DC, and that any on-premises SharePoint is patched or gone.
Source: Symantec
Also worth knowing
- Police in ten countries, with Europol and Eurojust, took down the KillSec ransomware operation, seizing its leak site, five servers and at least 110TB of stolen data. Its alleged main operator is 16. At least 70 of its attacks hit German organisations. (BleepingComputer)
- Commvault will protect local Claude Cowork, Claude Code and OpenClaw configurations on managed laptops “in the coming months”, through existing endpoint licences. Discovery of the ChatGPT desktop app is available now. (VMblog)
- Rewind, the Ottawa SaaS backup vendor, has been majority owned by H.I.G. Growth Partners since July, and its CEO now talks about acquisitions. (BetaKit)
- Windows 11 26H2 turns settings backup on by default for Entra and Entra hybrid joined devices, though not in regions covered by the EU Digital Markets Act. (The Register)
- Index Engines says 47.8% of 1,064 ransomware strains it detonated in the first half of 2026 destroyed directory entries, against 18.3% that fully encrypted. Vendor research, but “no encryption detected” is not “clean”. (VMblog)
What to do this week
- List what each client’s restore depends on besides the data. Licence checks, identity, consoles, vendor support. Anything outside the isolated copy is a gap.
- Re-test backup email alerts against Microsoft 365 and Gmail. Basic Authentication goes in December.
- Alert on unexpected RMM installers. MSP360 and ScreenConnect in particular, on machines you do not manage with them.
- Add a SYSVOL check to the AD recovery runbook. Then patch or retire any on-premises SharePoint.
Backuptron’s weekly brief on backup and disaster recovery delivered as a service, read from Europe.
