BDRaaS Briefing: Count Everything That Can Act on Your Backups
Rubrik led the vendor week with a hosted service that takes NAS backup storage off the customer’s premises altogether. MSP360 shipped an MCP server that lets Claude or ChatGPT create backup plans and assign licences, not just read job status. CloudCasa added Dell PowerStore to its Kubernetes DR.
The common thread is how many things now hold standing permission over a backup estate. ConnectWise Cloud Backup is mostly back, but only for partners who re-authorise every Microsoft 365 tenant. A ransomware affiliate in a UK school estate read credentials straight out of the backup infrastructure. And the NCSC put a 2028 date on AI-assisted ransomware against UK infrastructure.
Vendor releases
Rubrik hosts NAS backups in its own cloud
Rubrik-Hosted Protection for On-Premise Unstructured Data is generally available. Built on NAS Cloud Direct, it moves backup storage, capacity management and updates to Rubrik’s cloud, leaving software components on the customer’s servers instead of backup appliances. Backups sit in a hosted vault on a separate identity domain with retention lock, and can be restored to another array, to cloud storage or to an isolated recovery environment. Sensitive data discovery for primary file shares is in preview. Pricing and regions are not published, ChannelLife reports.
The practical bit: Rubrik is aiming at enterprises facing a hardware refresh, which is also when an MSP’s own NAS backup offer gets compared with it. With no regions published, where the vault sits is the first question any European client with residency terms will ask. Get the answer before they do.
MSP360’s MCP server can change things, not just report them
MSP360 has released an MCP server connecting Managed Backup to Claude and ChatGPT. As well as reading status and investigating failed plans, it can authorise pending computers, assign licences, create backup plans and companies, set storage caps and add administrators. It acts with the permissions of whichever MSP360 account signs in, sign-in happens on the Management Console rather than in the chat, and both assistants can require approval before an action runs. No separate charge is listed, according to MSP360.
The practical bit: An assistant signed in as a provider administrator can do everything that administrator can. Give technicians a reporting-only role to try it with, and turn on the approval step before anyone connects an account that can create admins.
CloudCasa adds PowerStore failover for Kubernetes
Dell PowerStore is now a replication provider for CloudCasa DR, alongside HPE Alletra and SUSE Storage. The array replicates persistent volumes and CloudCasa runs failover and failback for Kubernetes applications and KubeVirt VMs. A read-only MCP server is also available now, and changed block tracking for KubeVirt backups is in preview. CloudCasa DR is licensed per worker node on annual subscription, StorageReview reports.
The practical bit: Clients moving VMs off VMware onto KubeVirt still expect the DR they had before, and this keeps array replication in the design. CloudCasa chose read-only for its MCP server, which is a useful comparison with the item above.
As a service
ConnectWise Cloud Backup is back for re-authorised tenants
ConnectWise’s 4 November update says backups and restores work again for Microsoft 365 tenants re-authorised through a new application, “ConnectWise Cloud Backup for M365”. Billing and parts of the platform dashboard are still being restored. ConnectWise says existing archives remain encrypted and isolated “with no indication of compromise”, that re-authorisation alone does not prove backups are running, and that partners should not re-enable previously disabled applications unless told to, on its Trust Center.
The practical bit: A tenant nobody has re-authorised has had no Microsoft 365 backup since the service was suspended in October. Go through the tenant list and confirm a fresh snapshot in each, rather than trusting a green status.
Southend council moves to Veeam’s cloud vault
Southend-on-Sea City Council has replaced its previous backup product with Veeam and uses Veeam Data Cloud Vault for off-site immutable copies of its Azure workloads, having gone from about 500 on-premises VMware VMs to about 100 on-premises and 100 in Azure. Its security team made immutable backups “a requirement rather than a nice-to-have”, Blocks & Files reports. The same piece notes that Backup Exec stopped taking new sales on 31 March 2026, with support ending on 30 April 2029.
The practical bit: Every client still on Backup Exec now has a fixed date to move by. Find them and price the migration before their next renewal.
Redcentric pitches sovereignty beyond residency
Redcentric has sold its data centre business for £124.9 million, cut net debt to about £5 million and is repositioning around sovereign infrastructure for regulated customers. Chief executive Michelle Senecal de Fonseca says the conversation has moved past residency to who controls the infrastructure, the operations, the jurisdiction and the AI models. Not every customer needs it: “The local plumbing supplier, probably not,” she told IT Europa.
The practical bit: Who operates a service, and under which jurisdiction, applies to the backup copy as much as to production. If you sell into healthcare or the public sector, have a written answer for both.
Fortra sells recovery testing as a managed service for IBM Power
Continuity Care pairs FalconStor Habanero, which writes IBM Power data to immutable IBM Cloud Object Storage, with a clean room on IBM PowerVS and quarterly recovery validation tests with reporting. An entry tier covers backup reporting and validation only, StorageNewsletter reports.
The practical bit: The product is the scheduled restore test, sold as a recurring line. Most MSPs could package the same thing on the platforms they already run, and few do.
Who bought whom
Expedient buys phoenixNAP’s US VMware cloud and Veeam DR business
Expedient has acquired phoenixNAP’s US managed VMware cloud business and its Veeam backup and disaster recovery business, for an undisclosed price. phoenixNAP keeps its international operations and Bare Metal Cloud. Expedient says VMware service provider contracts that are not being renewed, phoenixNAP’s included, end in March 2027 as Broadcom consolidates its programme. Customers keep their environments at close and will migrate to Expedient Cloud on a schedule agreed with each, HostingJournalist reports.
The practical bit: This is the second VMware cloud estate to change hands in two weeks, after 11:11 took on IBM’s customers. If a client’s DR target is a VMware cloud, ask its provider now whether its Broadcom contract is being renewed.
What is being exploited
3AM affiliate read credentials from a UK school estate’s backup infrastructure
Bitdefender says a 3AM ransomware affiliate encrypted 37 machines in a UK school estate in September and exfiltrated 40 finance files. The attackers took credentials stored in the backup infrastructure and decrypted them with the Windows Data Protection API, created two backdoor domain admin accounts and used domain trusts to reach other schools. Bitdefender believes parts of the work were AI-assisted, judging by the timing of retries, Infosecurity Magazine reports.
The practical bit: Credentials a backup server stores for the hosts it protects are only as safe as the domain it sits in. Keep backup servers out of the production domain, and treat anything saved there as exposed if that domain falls.
Synology NAS boxes on old DSM builds are being hit by ransomware
Synology warned on 29 October of ransomware attacks on NAS devices running outdated DSM. It pointed to a November 2024 advisory that includes CVE-2024-10441, an unauthenticated remote code execution flaw rated 9.8, without confirming which flaw is being used. Fixes have been available since December 2024, Security Affairs reports.
The practical bit: Small clients often use a Synology as the backup target. Check the DSM version on every one you manage, including the one in the comms cupboard nobody has logged into for a year.
Regulation and compliance
NCSC puts a 2028 date on AI-assisted ransomware
The NCSC’s State of the Cyber Nation report, launched on 3 November, says AI-powered malware is “highly likely” to be used by financially motivated attackers against UK power stations, airports and hospitals by 2028. Chief executive Richard Horne blamed “tech on the cheap”: end-of-life systems, deferred upgrades and weak access control. Cyber Essentials for SMEs is also being discounted by 75%, to £80 to £125 plus VAT, Infosecurity Magazine reports.
The practical bit: Cheaper Cyber Essentials will bring small clients asking for help with it, and certification is a natural point to raise backup scope and restore testing. Have a price for both.
Also worth knowing
- NAKIVO’s third quarter revenue grew 13%, with EMEA providing 58% of it, and its MSP count rose 23% year on year (SecurityBrief).
- Backblaze’s computer backup revenue fell 2% to $16.2 million in the third quarter while B2 cloud storage grew 47% to $30.5 million (Blocks & Files).
- N-able is tracking a separate campaign abusing service principal credentials against MSP and customer Entra tenants, first seen on 1 November, and has published indicators (N-able).
- Climb Global Solutions has bought French distributor NeoVAD, whose lines include Cato Networks, DataCore and Netwrix (ChannelLife).
What to do this week
- If you use ConnectWise Cloud Backup, confirm a fresh snapshot in every Microsoft 365 tenant, not just that it was re-authorised.
- Check DSM versions on every Synology you manage, backup targets first.
- Review which credentials your backup servers store, and which domain can read them.
- List clients still on Backup Exec, and those whose DR target is a VMware cloud facing the March 2027 contract date.
