Ransomware 2025: Server Hardening & the 3-2-1 Backup Rule for SMBs

Ransomware Evolves: The Target Is No Longer Just Your Data — It's Your Backups

Just a few years ago, the standard response to a ransomware incident was: "We have a backup, we'll restore the data." Today, that statement can be dangerously misleading. Modern cybercriminal groups — RansomHub, LockBit 4.0, Akira, BlackSuit — spend weeks quietly penetrating corporate networks before triggering the encryption payload. During that time, they map the entire infrastructure, identify backup servers, NAS shares, and backup job schedules. Their singular objective is to destroy or encrypt backup repositories before encrypting production data, stripping organisations of any ability to self-recover.

With over 23 years of hands-on engineering experience at AbejaIT — designing and securing infrastructure for SMB clients across Poland — I see this as a fundamental architectural failure, not merely a technical one. Companies invest in firewalls and antivirus solutions while neglecting a coherent Disaster Recovery strategy. This article is an engineering response to the growing threat: a concrete server hardening checklist and backup architecture you can implement or commission today.

Anatomy of a Modern Ransomware Attack Against SMB Infrastructure

Phase 1 — Initial Access

The most common entry vectors are:

• Phishing with malicious attachments or links — emails impersonating invoices, HR documents, or bank notifications.
• Vulnerable internet-facing services — RDP (port 3389) without a VPN gateway, unpatched Fortinet VPN, PulseSecure, Citrix.
• Weak passwords or absence of MFA on domain administrator accounts or cloud management consoles.
• Malicious code in third-party software — supply chain attacks that bypass perimeter defences entirely.

Phase 2 — Reconnaissance and Privilege Escalation

Once inside the network, attackers patiently (often for 14–30 days) map the infrastructure using tools such as BloodHound, Mimikatz, and Cobalt Strike. Their goal is a Domain Admin account or a local administrator account on the backup server. At this stage, the organisation typically has zero awareness of the intrusion.

Phase 3 — Backup Destruction and Encryption

Attackers first delete or encrypt backups — VSS Shadow Copies, Veeam repositories, NAS shares — and only then activate the production-side encryption payload. According to Mandiant and Sophos threat intelligence reports, the median dwell time between initial access and ransomware activation is approximately 9–11 days. During that window, the scheduled backup jobs may have already overwritten clean snapshots with infected ones multiple times over.

Key engineering insight: A backup server connected to the corporate network and accessible via the same domain accounts as production servers is NOT a real backup — it is an additional attack surface.

The 3-2-1 Rule — A Foundation That Now Demands Extension to 3-2-1-1-0

The classic 3-2-1 rule states:

• 3 copies of data (original + 2 copies),
• 2 different storage media types (e.g., local disk + tape or NAS),
• 1 copy kept off-site.

Against the backdrop of modern ransomware, the industry has moved to the 3-2-1-1-0 model:

• +1 — one copy must be immutable (air-gapped or WORM-protected), inaccessible via standard network accounts,
• +0 — zero errors on recovery testing: an untested backup is a non-existent backup.

Immutable Backup Technologies in Practice

• Veeam Backup & Replication with Hardened Linux Repository — a dedicated Linux server with single-use credentials, immutable flags on an XFS filesystem, no access via domain accounts.
• Object storage with Object Lock (S3 API) — MinIO on-premise, Wasabi, Backblaze B2, or AWS S3 with Object Lock in COMPLIANCE or GOVERNANCE mode.
• LTO tape with air-gap — physical disconnection of the media from the network; costly, but essential for critical datasets.
• Offsite cloud backup to a public cloud provider (AWS, Google Cloud, Azure) using a completely isolated account with MFA, separated from the production environment.

Engineering Hardening Checklist — Linux and Windows Servers

Linux Servers (Debian, Ubuntu, RHEL/Rocky Linux)

• ✅ Disable root SSH login (PermitRootLogin no in /etc/ssh/sshd_config).
• ✅ Enforce SSH key-based authentication only — disable password login (PasswordAuthentication no).
• ✅ Change the default SSH port (or gate access behind VPN / port knocking).
• ✅ Deploy fail2ban or sshguard — automatic IP blocking after failed login attempts.
• ✅ Host-based firewall: UFW or nftables — default DENY rule, administration restricted to whitelisted IPs.
• ✅ Automatic security updates: unattended-upgrades (Debian/Ubuntu) or dnf-automatic (RHEL).
• ✅ Configuration auditing: Lynis or OpenSCAP — regular scanning against CIS Benchmarks.
• ✅ AppArmor (Ubuntu) or SELinux (RHEL) in enforcing mode — restrict process privileges to the absolute minimum.
• ✅ File integrity monitoring: AIDE or Wazuh — alerts on unauthorised changes to system files.
• ✅ Centralised logging: all system logs shipped to an external SIEM (Wazuh, Graylog) — prevents attackers from erasing their tracks.

Windows Server (2019/2022)

• ✅ Disable SMBv1 — the protocol exploited by WannaCry and its successors.
• ✅ Enable Windows Defender Credential Guard and LSA Protection — defences against Mimikatz-style credential theft.
• ✅ RDP accessible exclusively via VPN or Microsoft Entra ID Application Proxy — zero direct internet exposure.
• ✅ LAPS (Local Administrator Password Solution) — unique, rotated local administrator passwords on every machine.
• ✅ Principle of Least Privilege — no day-to-day user operates under a Domain Admin account.
• ✅ Windows Event Forwarding to a central log server — events 4624, 4625, 4648, 4688, 4698 (scheduled tasks) as early-warning signals.
• ✅ Disable PowerShell v2 (Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root) — the version without script block logging.
• ✅ Constrained Language Mode in PowerShell for unprivileged accounts.
• ✅ Regular VSS Shadow Copy restore tests — combined with immutable backup deployment (VSS alone is insufficient).

24/7 Monitoring as an Early-Warning System

Hardening is prevention. Monitoring is detection. Both elements are indispensable — without monitoring, you don't know whether your hardening is working (or failing). For SMB environments, we recommend the following stack:

• Zabbix or Prometheus + Grafana — resource monitoring, network traffic anomaly detection, process-level visibility.
• Wazuh (open-source SIEM/EDR) — event correlation, MITRE ATT&CK technique detection, alerts on suspicious processes.
• SMS/email alerting for critical events — failed logins, system file modifications, backup service interruptions.

AbejaIT's engineering team provides 24/7 server monitoring with defined SLAs and hands-on incident response — for both on-premise and cloud environments. On multiple occasions, our deployed monitoring stacks have detected intrusions in the reconnaissance phase, before the attacker had the opportunity to encrypt a single byte of data.

Disaster Recovery Architecture for SMBs — Step by Step

Step 1: Data Inventory and Classification

Identify which data is critical to operational continuity (client records, invoices, ERP database, server configurations). Define your RTO (Recovery Time Objective) — the maximum tolerable downtime — and RPO (Recovery Point Objective) — the maximum tolerable data loss measured in time.

Step 2: Implement 3-2-1-1-0 Compliant Backup

Automated local backup (Veeam, Bacula, Restic), a copy to NAS or tape (different media type), an offsite copy to a cloud provider (isolated account), and at least one immutable copy with Object Lock enabled. Recovery tests: minimum quarterly, results formally documented.

Step 3: Network Segmentation

The backup server must reside in a separate VLAN with no access from the domain network via standard accounts. Communication must be unidirectional — the backup server "pulls" data; it must never be accessible as a network share from production systems.

Step 4: Incident Response Plan (IRP)

A written procedure covering: who does what upon ransomware detection? Network segment isolation, executive notification, contact with CERT Polska, scope assessment, recovery decision. Without a written plan, every organisation improvises at the worst possible moment.

How AbejaIT Supports Businesses in Building Ransomware Resilience

For over 23 years, we have designed, deployed, and administered IT infrastructure for Polish businesses — from small multi-person firms to large production environments with hundreds of workstations. Our server administration and IT infrastructure services cover the full lifecycle: from vulnerability auditing and configuration hardening to immutable backup repository deployment and round-the-clock monitoring.

Whether you operate a scrap metal procurement business using the ESSW system (zlom.io), a coal and solid fuel depot using wegiel.io, or manage your company's finances through mojafirma.io — all of these systems operate on data whose loss or encryption translates directly into operational and legal consequences. Protecting your infrastructure is protecting the continuity of your business.

Summary — What Management and IT Directors Should Do Within 30 Days

• 🔐 Week 1: Privileges audit — remove redundant admin accounts, enforce MFA on all remote access services.
• 💾 Week 2: Backup verification — confirm that copies are isolated from the domain network and execute a live restore test.
• 🛡️ Week 3: Hardening — apply the Linux and Windows checklists, enable automatic security patching.
• 📊 Week 4: Monitoring — deploy a SIEM solution or commission 24/7 monitoring, draft a written IRP.

Ransomware is not a question of "if" — it's a question of "when." Organisations that treat cybersecurity as a one-time project rather than a continuous engineering discipline end up paying ransoms or losing data permanently. Organisations that treat it as architecture survive the incident and resume operations within hours, not weeks.

If you want to conduct a security audit of your infrastructure or implement the backup architecture and hardening strategy described above — contact the AbejaIT engineering team. We will analyse your environment and propose a concrete, tailored action plan.

Source reference: CERT Polska