AI Is Finding New Ways In: Will Your Backups Survive?

In July, I wrote about how AI is making credential theft cheaper and faster, and why backup environments have to hold up even when an administrator account is compromised. The answer was an assume-breach approach: design recovery around the certainty that an attacker will eventually get in, rather than the hope that they won’t.

Since then, AI-driven attacks have kept coming, and one of the latest ones puts that approach to a harder test. What happens when attackers don’t need to steal a credential at all?

Inside the DIVD breach

On September 21, the Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer-run nonprofit that finds and reports security flaws for a living, was breached through two previously unknown vulnerabilities in Zammad, the open-source helpdesk software behind its ticketing system. According to DIVD, the two flaws together allowed session hijacking, remote code execution, and privilege escalation to root, and that chain took seconds because of the agentic part of the attack. After reaching root, the actor used AI agents for the rest of the intrusion. DIVD points to attack scripts that carried notes in which the agent justified its own actions as evidence.

A team whose job is finding vulnerabilities got hit by two it didn’t know existed. From root, DIVD says, the attackers could reach other services and exfiltrate data. DIVD later confirmed that volunteer data, including email addresses, got out.

What the timeline shows

DIVD has been open about its numbers. Its monitoring flagged the first signals within minutes, with a mean time to detect of 19 minutes. It then took 19 hours to mount a first response, and the plan took another 9 hours to carry out, partly because the team had to gather in person and isolate its systems without cutting itself off from the network. DIVD confirmed on October 3 that the attack was contained.

Two things helped. Network segmentation and the work of its IT and incident response teams stopped the attackers from going deeper, and the attack was, in DIVD’s words, “loud and very messy,” which gave the team more to notice. DIVD said it would treat the breach as a worst-case scenario and assume a breach until it could prove otherwise.

Why the clock matters for your backups

Zero-days have been part of the threat landscape for years. What concerns me now is how much AI can accelerate what happens after the initial breach.

Once attackers have privileged access, they still have work to do. They need to navigate systems, locate sensitive data, and identify the credentials and API tokens that control your backups. For human attackers, each of those steps took time, and that time worked in the defender’s favor. It gave monitoring a chance to fire, a team a chance to assemble, and a response plan a chance to take effect.

AI agents change that math. DIVD described an agent working automatically and deciding each next step itself, at speed. An agent doesn’t wait for a handoff or lose time getting oriented, and it can pursue several paths toward your backups at once. The window defenders have to contain the damage is getting shorter, and every minute inside it is a minute the attacker can spend closing in on your recovery copy.

Attackers often go after backups first, because the recovery copy decides how much leverage they have. If it survives, a victim can restore and refuse to pay a ransom. If it doesn’t, restoring stops being an option and the conversation changes.

That’s why assume breach has to go beyond stolen credentials. Strong passwords, MFA, and prompt patching all reduce risk, but DIVD shows that none of them can promise to keep an attacker out. A flaw nobody knows about can’t be patched, so patching alone can’t close every door. Your recovery copy needs protection that still works after an attacker is already inside.

What your recovery plan needs when everything upstream fails

Notice what helped DIVD contain the attack: segmentation and isolation. The same thinking applies to recovery data. Whatever tools you use, a resilient recovery plan rests on six safeguards:

• Immutability: Lock backup data so no one can alter or delete it for a set period, administrators included.

• Separation of duties: Require more than one person to approve destructive actions, so a single compromised account can’t erase recovery data.

• Scoped access: Enforce MFA and least-privilege permissions so every account reaches only what it needs.

• Isolation: Keep at least one copy out of reach of production systems and the identity layer that protects them.

• Visibility: Log access and alert on unusual data movement, so a fast detection leads to a fast response.

• Tested recovery: Practice restoring on a schedule, so the plan holds at the speed you’ll need it.

How Wasabi protects the last copy

The Wasabi cloud builds each of these safeguards into the storage layer, so the protection doesn’t depend on the systems an attacker has already compromised.

Start with immutability. Wasabi Object Lock keeps backup data locked against changes and deletion for the retention period you set. Choose Compliance Mode, and recovery points stay protected even if an admin account itself is compromised.

Destructive requests get a second set of eyes. With Multi-User Authorization (MUA), you designate up to three independent security contacts, and each one must approve actions such as deleting a storage account or bucket before Wasabi will proceed. A single stolen administrator login can’t set that in motion alone.

Around the data itself, MFA, least-privilege IAM policies, encryption, audit logging, and egress alerts each address a different stage of an attack, spanning identity, access, data, and exfiltration. An attacker has to beat all of them.

For the copy you can’t afford to lose, there’s Wasabi Covert Copy™. It maintains a hidden, logically isolated, immutable copy of critical backup data that stays out of standard bucket listings, and reaching it takes approval from multiple users. Compromised administrator credentials alone can’t reach or destroy it. Object Lock stops an attacker from deleting your backups, and Covert Copy goes a step further by keeping a copy out of sight in the first place.

Finally, rehearse the restore early and often. Wasabi does not charge fees for access, API calls, or egress, so you can test recovery as often as you like.

Build for the compromise you didn’t see coming

For October’s Cybersecurity Awareness Month, ask your team three questions. Where does your recovery copy live? Who can reach it? And what would an attacker with root access see if they went looking?

Detection and response will always matter, and DIVD’s story shows why. But they can’t be your last line of defense when response takes hours, and the break-in takes seconds.

AI is changing how attackers get in, but your recovery plan has to work anyway.