Rubrik wires ReversingLabs' ransomware feed into the scans that pick a clean recovery point

KNP Logistics is the case ReversingLabs opens with. The Akira group guessed one employee's password ^[2]. By the end the data was encrypted and the servers, the backups and the disaster recovery systems had all been destroyed ^[3]. The ransom demand ran as high as 5 million pounds, which KNP could not pay, and it had nothing left to restore from ^[4]. The company shut down and 700 people lost their jobs ^[5]. It had been moving freight around the United Kingdom for 158 years ^[1]. Snapshot scanning has nothing to work on in a case like that, because there were no snapshots left to scan.

The failure the integration does address is a payload already sitting in a snapshot an operator is about to restore. Threat Monitoring matches indicators against backup snapshots on the infrastructure already holding the data ^[9]. Threat Hunting adds file pattern, file hash and YARA matching, and walks the time-series history of snapshots to pinpoint a clean recovery point ^[10]. Rubrik's estimate is up to 75,000 backups in about 60 seconds ^[10], which works out to roughly 1,250 backups a second ^[21].

The feed is file hashes tied to known families, command-and-control infrastructure pulled from malware configurations, and payload delivery URLs ^[11]. Each indicator carries a MITRE ATT&CK mapping and a kill-chain stage tag of early, mid or late ^[12]. For a responder that tag separates a match showing staging from a match showing the encryptor. ReversingLabs ages inactive indicators out rather than letting them pile up and dilute the signal ^[13], and says this matters when the catalog spans years; the post skips the retention window that would set how far back a match stays possible ^[23].

"Threat intelligence is only as valuable as it is current", said Adam Turner, Threat Detection Product Manager at Rubrik ^[15]. Turner said the integration "sharpens what our customers can detect in the data they will actually recover from" ^[16]. ReversingLabs puts its corpus at more than 420 billion goodware and malware samples, with a file reputation database covering more than 40 billion files ^[14].

The part of the pattern the announcement documents best is the access path into the backup platform itself. CVE-2024-40711, from September 2024, was an unauthenticated remote code execution flaw in Backup & Replication rated 9.8 ^[17]. Sophos X-Ops observed Akira and Fog exploiting it within weeks, and thousands of instances were still unpatched a month after the fix shipped ^[18]. In 2025 it was CVE-2025-23120 ^[19]. Then in March 2026 came CVE-2026-21666, CVE-2026-21667 and CVE-2026-21708, each rated 9.9, alongside high-severity file manipulation and privilege escalation issues ^[20]. Closing those means patching the backup server; scanning what it stores leaves them open.

The figure carrying the argument, that 96% of ransomware attacks target backup storage specifically, is Rubrik's own research, and the post gives no methodology or sample size ^[6][24]. Price, availability date, licensing tier and a measured detection rate are all absent too ^[22].