StormVeil ransomware crew pivots to ERP backup appliances in coordinated European campaign

A quiet change in tradecraft

For most of the past two years, StormVeil looked like a conventional big-game ransomware operation: initial access through edge appliances, a slow crawl toward domain administrator, and a Friday-evening encryptor. The campaign that began on 2 July inverts that order. According to three incident responders who have worked separate cases, the group now goes for backup infrastructure first — and often only touches production once recovery is impossible.

The shift matters because it changes the economics of the negotiation. Organisations that could previously restore from immutable snapshots within a business day are now looking at multi-week rebuilds from offline media, if that media exists at all.

They are not encrypting to disrupt you. They are encrypting after they have already made sure you cannot say no.

How the intrusions start

In every case reviewed for this story, the initial foothold came from a valid account rather than an exploit. Two victims had backup service accounts exempted from conditional access policies so that overnight jobs would not fail. A third had reused a local administrator password across its virtualisation cluster and its backup proxy servers.

Once inside, the operators enumerate the backup catalogue rather than the file shares. Responders describe seeing API calls that read retention policy, then rewrite it:

PUT /api/v3/policies/{id}  {"immutable": false, "retentionDays": 0}

Only after the catalogue has been pruned does the encryptor land, usually pushed through the same management agent that the backup platform uses to reach endpoints.

Who has been affected

• 41 confirmed victims across manufacturing, logistics and industrial distribution
• Three regional hospital groups, all of which restored from tape
• One managed service provider whose downstream customers were reached through a shared console

What defenders should do this week

The advice from responders is unglamorous and consistent. Treat the backup platform as tier-zero infrastructure, on par with domain controllers. Require phishing-resistant multi-factor authentication for every human and machine identity that can change retention policy. Alert — loudly, to a pager — whenever immutability is disabled on any policy, for any reason.

Finally, test a restore from media that the production network cannot reach. Several organisations in this campaign discovered that their offline copy had silently stopped replicating months earlier.

• #Ransomware
• #Backup
• #ERP
• #Incident Response