회사 소식 Druva reacts to AI ransomware raids with AI responses

Druva leverages AI‑driven response capabilities to counter AI‑fueled ransomware assaults.

The backup and data resilience vendor notes attackers employ AI to explore more intrusion vectors, adjust tactics rapidly, and conceal malicious actions within normal business activity. Combined with stolen credentials and continuously evolving ransomware, classic security signals become far less reliable. Overall, AI makes it tougher for security teams to tell genuine system compromise apart from regular operations.

To address these challenges, Druva applies its graph‑relationship metadata analysis technology to examine suspicious identity activity and visualise attack blast radius. It pairs this with its proprietary AI threat pipeline, which analyses backup datasets to verify potential ransomware activity. This confirms incident impact and guides security and administrative teams on exact containment and recovery procedures to restore clean, trustworthy systems.

Yogesh Badwe, Druva’s Chief Security Officer, stated: “Security teams know they cannot block every attack. The real challenge is understanding exactly what unfolds once a threat penetrates defenses, and AI amplifies these risks of uncertainty. Prior to recovery, you need proof of modifications, compromise scope, and which data remains trustworthy. Druva draws on years of backup telemetry to validate threat signals and convert them into tangible evidence, delivering customers a solid factual foundation for recovery rather than guesswork.”

According to Druva, conventional anomaly detection can flag abnormal file activity yet forces administrators to sift through volumes of telemetry and reports to isolate genuine malicious events. Ransomware Detection’s AI‑powered threat pipeline solves this via multi‑stage behavioral analysis plus forensic validation that filters false alerts and delivers corroborated evidence. These updated features allow customers to:
● Identify ransomware patterns within snapshots: Deploy purpose‑built AI and machine‑learning models to scan backup snapshots for high‑risk signals including ransom notes, known malicious file extensions, bulk file renaming and other compromise indicators.
● Validate high‑risk alerts: Confirm ransomware presence and lower false‑positive rates through native in‑platform forensics covering structural checks, entropy measurement, MIME‑type inspection, file integrity and data analysis.
● Translate evidence into recovery workflows: Present interpretable findings within Recovery Insights, separate affected datasets from clean snapshots, and validate restore points ahead of recovery operations.

The firm also reconstructs attack paths to accelerate and de‑risk recovery. Dru Metagraph delivers an interactive view of human and non‑human identities (NHIs such as AI agents), associated activities and inter‑relationships across Microsoft Entra ID, Active Directory and Okta. It contextualizes changes across identities, permissions, applications, policies and timelines to illustrate how suspicious activity spreads across infrastructure, cutting investigation time from multiple days down to hours. Armed with this attack context, security administrators can:
●Map attacker behaviour and blast radius, identifying initial access points, privilege escalation, persistence mechanisms and lateral movement, aligned to relevant MITRE ATT&CK TTPs.
● Establish a trusted pre‑attack baseline: Leverage historical change logs and snapshots to reconstruct system state prior to breach and define required recovery scope.
●Convert behavioral evidence into targeted containment and recovery steps: Generate customized, pre‑validated recovery plans that list compromised objects, propose remedial actions, and pinpoint appropriate clean snapshots for restoration.

Bootnote
MITRE ATT&CK is an adversary‑behavior framework maintained by a US non‑profit technical advisory organization that manages federally funded research‑and‑development centers. ATT&CK represents Adversarial Tactics, Techniques, and Common Knowledge, a publicly available knowledge repository documenting real‑world attacker conduct. TTPs stand for Tactics, Techniques, and Procedures, describing practical threat actor behaviors during cyber‑attack campaigns.

Beijing Qianxing Jietong Technology Co., Ltd.
Sandy Yang/Global Strategy Director
WhatsApp / WeChat: +86 13426366826
Email: yangyd@qianxingdata.com
Website: www.qianxingdata.com/www.storagesserver.com
Business Focus:
ICT Product Distribution/System Integration & Services/Infrastructure Solutions
With 20+ years of IT distribution experience, we partner with leading global brands to deliver reliable products and professional services.
“Using Technology to Build an Intelligent World”Your Trusted ICT Product Service Provider!