Backmydata

Backmydata is a variant of the Phobos ransomware family, a malicious software (malware) designed to exploit and damage computer systems. It has been used in sophisticated cyber-attacks on healthcare entities, notably hospitals. The landscape of such attacks is evolving, with groups like RansomHouse, Rhysida, and others employing more advanced tactics. The method of breach involving Backmydata was intricate, suspected to have originated from the compromised website of the RSC infrastructure. This malware is part of an expanding list of Phobos variants including Devos, Eight, Elking, and Faust. In one significant incident, a threat actor affiliated with Phobos infected systems at approximately 100 hospitals in Romania. The attacker initially targeted a central health information system connected to these hospitals, subsequently spreading the Backmydata ransomware across the network. While no specific group claimed responsibility for this attack, the servers of the Hippocrates Information System were encrypted using Backmydata, with the unidentified attackers demanding a ransom of 3.5 BTC or 157,000 euros. In response to these escalating threats, US CISA, the FBI, and MS-ISAC issued a joint cybersecurity advisory (CSA) warning of attacks involving Phobos ransomware variants such as Backmydata. They underscored the importance of using Indicators of Compromise (IOCs) for scanning IT&C infrastructure across all health entities, irrespective of whether they had been affected by the Backmydata ransomware attack. As the sophistication of these attacks increases, vigilance and proactive measures are critical to maintaining the integrity and security of healthcare systems.