BDRaaS Briefing: When the Backup Tool Holds the Keys
Cohesity spent the week on recovery you can check before you need it. NetBackup Flex 8.0 scans backup images for malware on the appliance, and the Data Cloud releases put protection inside AWS European Sovereign Cloud. Veeam gave sovereignty a badge partners can earn.
The rest of the week was about trust in the provider. ConnectWise switched off its own Cloud Backup after the backup application’s identity was used to sign in to customer Microsoft 365 tenants. In London, one Google Cloud zone lost power, and banks and courts found there was no second UK region to go to.
Vendor releases
Cohesity takes backup into the European sovereign clouds
Cohesity’s latest Data Cloud releases extend protection to AWS European Sovereign Cloud, Google Cloud Dedicated and Oracle Alloy. Initial support covers SQL, NAS, Kubernetes and Google Cloud VMware Engine; EC2 and GCE virtual machines come in later releases. Threat scanning of Exchange, SharePoint and OneDrive backups is now generally available, and Microsoft 365 protection is moving from EWS to Graph, according to Cohesity.
The practical bit: If a client is moving regulated workloads into AWS European Sovereign Cloud, check what your backup tool can see there before you quote. Here it is databases, files and Kubernetes first, not VMs.
NetBackup Flex 8.0 scans for malware on the appliance
NetBackup Flex Appliance 8.0 became available on 19 October. Malware scanning runs on the appliance, so recovery images no longer go to a separate scan host. It also adds IPsec for agentless NDMP and NAS traffic, storage that can be dedicated to a priority workload, and API tokens that only work from approved network locations, Cohesity says.
The practical bit: Given the rest of this issue, switch on the location-bound tokens first. A stolen token that only works from the backup subnet is worth far less to an attacker.
As a service
Google Cloud loses a London zone, and there is no second UK region
On 20 October, just after 07:00, the europe-west2-b zone in Google’s London region lost power. Banking apps, Royal Mail, DPD, NHS England and the courts’ video platform were affected. Most services were back by mid-afternoon; the Ministry of Justice was still not fully restored at 15:52. A relayed engineering update said backup generators failed to engage, and one engineer reported the other two zones did not fully absorb the load. europe-west2 is Google’s only UK region, Computer Weekly reports.
The practical bit: Multi-zone is not multi-region. For UK clients on Google Cloud with residency rules, recovery outside London means either another provider in the UK or a deliberate decision to fail over abroad. Get that decision written down and signed off while the outage is fresh.
Veeam adds a data sovereignty competency for service providers
Veeam has launched a Sovereign Service Providers Program. Its first phase is a Data Sovereignty Competency inside VCSP, meant to help customers find providers who can show both the technology and the local operation, governance and jurisdiction. More is due later in the year. No providers or qualifying criteria were named, ITPro reports.
The practical bit: If sovereignty is in your pitch, ask your Veeam channel manager what the competency requires before a competitor puts the badge on their website. Expect questions about who operates the service and from where, not only where the data sits.
Who bought whom
Hosvara buys Dr. Backup
Hosvara has acquired Dr. Backup, a US backup provider that has sold through MSPs for more than two decades. Founder Mitch Romm stays on as an adviser for a year. Hosvara promises infrastructure and roadmap investment but has not said what comes first, ChannelE2E reports.
The practical bit: If you resell it, get data location, support hours and pricing commitments from the new owner in writing before your next renewal.
What is being exploited
ConnectWise Cloud Backup was used to sign in to customer tenants
ConnectWise found unauthorised access to application identities in Cloud Backup, formerly SkyKick, and suspended it along with SaaS Security and Cloud Management. It has reset accounts and replaced application credentials and is preparing a phased restoration. Huntress saw the application grant itself Global Administrator and add secrets to other applications for persistence, The Hacker News reports. Microsoft attributes the campaign to Storm-0940, a China-linked group using an open source AI penetration testing framework called ARTEX, which attempted to authenticate against more than 2,250 Microsoft 365 tenants. Microsoft has not said how many were compromised, The Register reports.
The practical bit: A Microsoft 365 backup app holds standing permission over every tenant it protects, and nobody types a password to use it. Whoever you back up with, list each tenant’s backup application, its permissions and secrets, and check its sign-ins. ConnectWise users should leave the apps disabled until restoration instructions arrive, and check every tenant for new Global Administrators and new application secrets first.
SafePay advisory names two Veeam flaws and wipes NAS backups
US, UK and German agencies have issued a joint advisory on SafePay, which they say has hit at least 600 victims. Its CVE list includes CVE-2023-27532 and CVE-2024-40711 in Veeam Backup & Replication. The group stops Volume Shadow Copy and resets NAS devices holding backups to factory settings, the advisory says.
The practical bit: Both Veeam flaws were patched long ago, so any server still exposed is a backlog item that has become a risk. A NAS the domain can reach is not a backup the attacker cannot touch.
OVHcloud CLI releases swapped for a secret stealer
On 19 October a hijacked contributor’s GitHub account was used to replace the archives of OVHcloud CLI v0.11.0 to v0.15.0 with a build that steals secrets from disk. They were live for up to 94 minutes, from 12:47 to 14:21 UTC. The official install script checks no hash; Homebrew’s pinned hash protected its users. A clean v0.16.0 is out, The Hacker News reports.
The practical bit: If any machine or pipeline of yours installed or upgraded the CLI in that window, rotate every credential it held, OVHcloud API keys first.
Regulation and compliance
MPs and the EBA ask questions about the Google outage
Dame Meg Hillier, chair of the Treasury Committee, has asked the Bank of England and the FCA how they will use their powers in response, with an initial reply due by 4 November, City AM reports. The European Banking Authority is also assessing the impact on EU financial firms. Google falls under both the EU and UK critical third-party regimes, and under both, banks stay responsible for services that rely on third parties, Reuters reports.
The practical bit: The questions will run downhill. Financial-services clients will be asked how their recovery held up, and they will ask their suppliers. Have your account of 20 October ready, including what you would have done had it lasted a day.
ICO reprimands a Welsh public body and its IT provider over “Password1”
The ICO has reprimanded Data Cymru and its IT provider, Ogi Networks, after a November 2024 ransomware attack that came in through a 12-year-old test account with the password “Password1”. Around 3,300 people were affected, most of them children. The provider had not enforced password rules or audited accounts it created, and the contract lacked sub-processor terms, Infosecurity Magazine reports.
The practical bit: The provider was named alongside the client. Audit the test and service accounts you created at onboarding, and check every contract carries data processing terms.
Also worth knowing
- Acronis Cyber Protect Cloud is now Acronis Cyber Platform, with a new Cyber Console in early access (Acronis).
- Qilin and Inc are still exploiting CVE-2026-0257 in PAN-OS GlobalProtect to bypass MFA, five months after the patch (The Register).
- Hornetsecurity is adding a tenant risk dashboard with a cross-tenant MSP view to 365 Permission Manager in Q4 (Hornetsecurity).
- Dutch sovereign neocloud Nebul has added DDN storage alongside NetApp and VAST Data (Blocks & Files).
What to do this week
- On every Microsoft 365 tenant you protect, list the backup application’s permissions and secrets and review its sign-ins.
- Confirm no Veeam Backup & Replication server you run is exposed to CVE-2023-27532 or CVE-2024-40711, and no backup NAS is reachable from the domain.
- For UK clients on Google Cloud, write down where recovery goes if London is down, and get it signed off.
- Audit the test and service accounts you created at onboarding, oldest clients first.
