New Ransomware Strain Targets Backup Software – Here’s Why Softyz Inc Users Are Protected
A new ransomware variant identified this week specifically targets popular local backup tools by encrypting their cache files and connected drives before encrypting the rest of the system. Here’s a technical breakdown of how it works, the indicators of compromise, and why Softyz’s architecture makes this entire attack vector ineffective.
This week, security researchers identified a new ransomware variant that introduces a notable evolution in tactics: before encrypting a victim’s general files, it specifically searches for and targets local backup software caches and connected backup drives first.
This is a meaningful escalation. Traditional ransomware encrypts files indiscriminately. This new approach deliberately prioritises destroying the victim’s ability to recover – by going after Time Machine caches, Windows File History snapshots, and externally connected drives matching common backup signatures, before moving on to documents and photos.
If you are a Softyz Inc user, you are already protected against this attack vector. This article explains exactly why – and what to check to confirm your protection is active.
How this attack chain works
Based on reported behaviour patterns, the attack proceeds through these stages once a device is compromised – typically via a phishing attachment or a trojanised installer:
Initial access & reconnaissance
The malware gains a foothold and spends time scanning the file system – looking specifically for known backup software directories, drive letters, and process names associated with popular backup tools.
Backup cache and connected drive targeting
The malware locates local backup caches – Time Machine local snapshots, Windows File History storage, and any externally connected USB drives or NAS shares with recognisable backup folder structures – and encrypts these first.
Attempted cloud sync poisoning
For victims using cloud sync services, the malware encrypts local files within the sync folder – and the sync client dutifully uploads the encrypted versions, overwriting clean cloud copies within minutes.
General file encryption & ransom note
With local backups destroyed and cloud sync copies poisoned, the malware encrypts the victim’s documents and photos, then displays a ransom note. Victims relying only on local or sync-based “backup” have no clean recovery option left.
Why Softyz’s architecture neutralises this attack vector
This variant is specifically engineered to defeat local backup strategies and sync-based “backup” – the two approaches most people unknowingly rely on. Softyz Inc was architected from day one around assumptions that directly counter both:
- No local backup cache to find or encrypt – there is nothing on your device for the malware’s drive-scanning logic to locate.
- WORM immutability prevents overwrite – even a “legitimate-looking” re-upload from a compromised device cannot replace existing clean versions.
- Scheduled time anomaly detection isolates compromised devices automatically – a sudden mass-encryption event triggers isolation of that device’s backup connection within seconds.
- Zero-knowledge encryption means your cloud copy is unreadable without your private key, which never leaves your device unencrypted.
“This variant is a reminder that ransomware groups study defensive tools and adapt. The response isn’t panic – it’s making sure your backup architecture doesn’t have the local attack surface this malware is designed to exploit.” – Priya Sundaram, CTO, Softyz Inc.
3 things to check right now
General precautions beyond Softyz Inc
- Don’t open unexpected attachments – even from known contacts. Verify via a separate channel if uncertain.
- Download software only from official sources – trojanised installers are a common distribution method.
- Keep your OS and antivirus updated – many variants exploit known, patchable vulnerabilities.
- Enable 2FA on your Softyz Inc account – Account → Security → Two-Factor Authentication.
- If you suspect infection, disconnect from the network immediately and follow our ransomware recovery guide.
- Disconnect the device from your network immediately
- Do NOT pay the ransom – your Softyz Inc cloud backup is unaffected
- Access softyzinc.com from a different, clean device
- Identify your last clean restore point (immediately before the attack)
- Wipe the infected device and reinstall the OS
- Reinstall Softyz Inc and restore your files from the clean version
- Contact support@softyzinc.com for guided recovery and a post-incident audit