L1
Classic Ransomware
Encrypts production data only; recovery via backups is possible.
Add RunStor on WeChat for tailored DR solutions.
Long-press to follow · WeChat Official Account「RunStor」
OUR SOLUTIONThe last line of defense against ransomware — kernel-layer I/O blocking plus immutable storage proactively immunize against malicious attacks, with second-level rollback after a breach.
Ransomware and similar malicious attacks have surged in recent years with continuously evolving tactics — expanding from simple file encryption to a "steal + encrypt" double-extortion model. Attackers not only encrypt production data but also launch targeted attacks on backup systems, encrypting or deleting backup data to completely sever the victim's recovery path.
If a traditional backup system shares the same trust domain as the production network and its backup media are reachable online, it can easily be encrypted or deleted by ransomware along with everything else. Once backup data falls, an organization cannot recover even by paying the ransom — trapped with no one to pay and nothing to restore. In 2024, a financial institution saw all core transaction data encrypted after its backup system was breached, with business down for more than 72 hours and direct losses in the hundreds of millions — the security of backups themselves determines whether the last lifeline holds under ransomware attack.
Encrypts production data only; recovery via backups is possible.
Finds and deletes/encrypts backup data, fully blocking the recovery path.
Attacks the backup management platform, tampering with backup policies and deleting historical recovery points.
When backup data is encrypted or deleted along with production data, even paying the ransom may not restore data — organizations face multiple crises of <b class="accent">business shutdown, permanent data loss, reputational damage and regulatory penalties</b>.
Monitor every I/O request written to backup media in real time at the kernel driver layer, precisely blocking non-compliant operations for tamper-proof, delete-proof backup protection. The IO filter uses whitelist management based on internal process IDs (PID), allowing only the backup software's own legitimate write operations; access, encryption or deletion of backup data by any other process — including ransomware with administrator privileges or insider malware — is blocked in real time. This mechanism needs no signature database updates and defends against known, unknown and variant ransomware.
Based on the WORM (Write Once, Read Many) principle, backup data is locked read-only once written and cannot be modified, deleted or overwritten by any entity — including system administrators and attackers with root privileges — during the configured retention period. Even if ransomware breaches the system and gains the highest privileges, it cannot encrypt, tamper with or delete stored immutable backups. WORM storage supports multi-copy protection, syncing immutable copies to offsite storage or cloud platforms for a double layer of ransomware defense and offsite DR.
Combined with CDP technology, every I/O change is recorded in real time and any historical point in time is recoverable. After a ransomware attack, there is no need to wait for decryption or redeploy systems — directly select the last healthy point before the attack and roll back to a healthy state within seconds for rapid business recovery. Kernel-layer I/O blocking also stops abnormal writes during rollback, ensuring the recovered environment is clean and trustworthy.
Kernel-layer non-compliant I/O blocking precisely whitelists legitimate backup processes by process ID, preventing ransomware from encrypting, tampering with or deleting backup data — effective against known, unknown and variant ransomware.
Data is locked read-only upon writing and cannot be modified or deleted by any entity (including administrators) during the retention period — even if the system is compromised, backup data stays intact.
With CDP point-in-time recovery, roll back directly to the last healthy point before the attack — no decryption wait, business running again within minutes.
Fully meets MLPS 2.0, the Data Security Law and industry regulatory requirements for data backup and recovery; backup logs and recovery drill records are retained automatically, with auditable assessment materials.
Core government systems deployed with ransomware defense — kernel-layer I/O blocking plus WORM immutable storage protect government data from ransomware encryption and safeguard citizen information security.
HIS core systems protected with CDP + immutable storage, effectively defending against ransomware targeting healthcare — keeping clinical operations running 7×24 without impacting patient care.
ERP, MES and other production-critical systems protected with local immutable storage plus offsite copies — production data rolls back within seconds after ransomware encryption, keeping production lines running.
Our technical consultants respond instantly to assess your ransomware protection readiness.