Cohesity REDLab tests 53 ransomware families: successful backups still need content verification
Cohesity REDLab published backup infrastructure tests against 53 ransomware families, warning that successful backup jobs may still contain encrypted data or malware. The research proposes evaluation criteria including separate credentials, anomaly detection and verification before restoration.
Source Facts
On 30 July, Cohesity introduced a REDLab report describing tests of 53 ransomware families against backup infrastructure in an isolated laboratory, observing effects on data, settings, communications and recovery mechanisms. This is vendor laboratory research, not an independent test repeated by this site.
The article says that in test scenarios with certain protections disabled, backup jobs could complete while capturing encrypted data. It proposes assessing backup resilience through credential separation, immutable copies, threat and anomaly detection, and restoration integrity checks.
A green backup job status only means the process completed. Recoverability must be demonstrated through readable data, functioning applications and business acceptance.
Original sources
Ransomware vs. The Last Line of Defense: What we learned from detonating 53 strains
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
Illustration