Ransomware has become the defining cyber threat for Indian businesses. It is no longer a risk confined to large enterprises or multinational corporations — hospitals in Hyderabad, manufacturing companies in Pune, and CA firms in Delhi have all faced ransomware attacks that encrypted critical data and demanded payment for decryption keys.
The conventional response — "we have backups, so we are safe" — turns out to be dangerously incomplete. Modern ransomware strains specifically target and destroy backup files before encrypting production data. This article explains why backup alone is insufficient, what Acronis Active Protection does differently, and how Indian organisations can deploy a genuinely ransomware-resilient architecture using Acronis Cyber Protect.
The Ransomware Crisis for Indian Businesses
India reported over 13 lakh cybersecurity incidents in 2023 according to CERT-In data, with ransomware accounting for a significant and growing share. Sectors hit hardest include:
- Healthcare — patient record systems, PACS imaging archives, billing platforms
- Manufacturing — ERP systems, production planning tools, SCADA interfaces
- Financial services — accounting software, client databases, transaction records
- Education — student data, examination records, administrative systems
- Government and PSU bodies — AIIMS Delhi suffered a widely reported ransomware attack in 2022 that disrupted services for weeks
The financial impact extends beyond the ransom demand itself. Downtime costs, data recovery expenses, regulatory penalties under CERT-In's incident reporting mandate, and reputational damage can collectively exceed the ransom by a factor of five to ten.
What has changed in recent years is the sophistication of attack delivery and the specific targeting of backup infrastructure. Ransomware operators now invest significant effort into understanding a target's backup topology before launching the encryption payload.
Why Traditional Backup Fails Against Modern Ransomware
Most IT teams believe that maintaining a backup means they can recover from any ransomware attack. This belief rests on an assumption that the ransomware will encrypt production data while leaving backup data untouched. That assumption was valid in 2015. It is not valid today.
Backup files are primary targets
Modern ransomware variants — LockBit, BlackCat/ALPHV, Cl0p, and their successors — include modules that specifically enumerate and delete or encrypt:
- Windows Volume Shadow Copies (VSS)
- Local backup folders and mapped network drives
- NAS shares accessible from the infected machine
- Tape or disk backup targets mounted as drive letters
- Backup agent databases and catalogues on the backup server itself
If your backup software stores its repository on a share that the infected machine can access, the ransomware will encrypt the repository. Your backups disappear at the same moment your production data does.
Backup software running during an attack creates corrupted backups
Backup agents run on a schedule — typically nightly or every few hours. If ransomware begins encrypting files at 2:00 AM and your backup job runs at 3:00 AM, the backup job may capture partially encrypted files, write them to the backup repository, and produce a backup set that is internally consistent but entirely unrecoverable. Your backup system has faithfully backed up corrupted data.
The gap between detection and encryption
Signature-based endpoint security tools detect known malware patterns. Ransomware operators routinely recompile and repack their payloads to evade signature detection. By the time a new signature is deployed to your endpoint agent, thousands of machines may have already been encrypted. Detection latency of even a few hours is catastrophic when ransomware can encrypt hundreds of gigabytes per minute.
The Gap Between Backup-Only and Endpoint-Security-Only Approaches
Two common approaches to ransomware defence each have a critical blind spot:
| Approach | What It Does Well | Critical Gap |
|---|---|---|
| Backup-only | Provides recovery path after encryption | Cannot prevent encryption; backups may be encrypted too |
| Traditional endpoint AV/EDR | Detects many known threats before execution | Misses novel/repacked strains; no recovery path if encryption succeeds |
| Integrated backup + anti-ransomware | Prevents encryption AND provides recovery | Requires a solution purpose-built for this integration |
Acronis Cyber Protect is purpose-built for the third approach. The backup engine and the anti-ransomware engine share a single agent and a single management console — they are not two separate products bolted together.
What Is Acronis Active Protection?
Acronis Active Protection is the AI and machine learning anti-ransomware engine built into Acronis Cyber Protect. Unlike signature-based detection, Active Protection does not rely on knowing about a threat in advance. It monitors process behaviour in real time and identifies ransomware by what it does, not by what it looks like in a signature database.
Behavioural Detection — Not Signature-Based
Active Protection observes running processes and looks for behavioural patterns characteristic of ransomware activity:
- Rapid, sequential file modification — opening many files in short succession and writing modified versions
- Entropy change in file contents — encrypted data has a measurably higher entropy than the original plaintext
- File extension changes — appending ransomware-specific extensions to modified files
- Interaction with the Windows Volume Shadow Copy service — legitimate applications rarely delete VSS snapshots; ransomware almost always does
- Process injection attempts — ransomware often injects into trusted processes to evade detection
- Communication with known command-and-control (C2) infrastructure
These behavioural indicators are architecture-level characteristics of the ransomware class, not characteristics of a specific strain. A newly compiled, never-before-seen ransomware variant will still trigger behavioural detection because it must exhibit these patterns to function as ransomware.
Real-Time Process Monitoring
Active Protection runs continuously as a system service, monitoring all process activity on the endpoint. The monitoring overhead is designed to be minimal — Acronis publishes benchmarks showing less than 1% additional CPU utilisation on typical workloads during normal operation.
When a process begins exhibiting suspicious behaviour, Active Protection does not simply log a warning. It moves to intervention within seconds.
Automatic Termination of Malicious Processes
When the behavioural engine determines that a process is engaged in ransomware-type activity with sufficient confidence, it terminates the process immediately. The termination happens at the operating system level — the process is killed regardless of how it was launched or what account it is running under.
This process termination is the primary line of defence. In most cases, ransomware is stopped before it has encrypted more than a small number of files.
Auto-Rollback of Affected Files from Local Cache
For the files that were modified before the process was terminated — which may be anywhere from zero to a few hundred depending on how quickly detection fired — Acronis Active Protection maintains a real-time local cache of original file contents.
When a malicious process is terminated, Active Protection automatically restores the affected files from this cache. The restoration happens automatically, without requiring administrator intervention or a formal backup restore operation. The affected files are returned to their pre-encryption state within seconds.
This rollback capability is possible because Active Protection and the Acronis backup agent share the same local data cache. The backup agent maintains recent versions of files to enable incremental backup operations; Active Protection leverages this cache for immediate rollback.
Additional Acronis Ransomware Defences
Active Protection is the most prominent anti-ransomware component, but Acronis Cyber Protect includes several additional layers that address different stages of a ransomware attack.
Backup Storage Protection
Acronis protects its own backup repositories from ransomware modification. The local backup cache and the connection to Acronis Cloud storage are protected from unauthorised access by other processes on the machine. Even if ransomware is running on the same endpoint, it cannot access or modify Acronis backup data through normal file system calls.
This is a critical architectural difference from backup solutions that store data in standard folders on network shares. Acronis backup data is inaccessible to ransomware even when running on the same machine.
Web Filtering
Acronis Cyber Protect includes a URL filtering component that blocks access to websites known to deliver ransomware payloads, phishing credentials, or malicious macros. Many ransomware infections begin with a drive-by download from a compromised website or a phishing email that links to a malicious domain.
Web filtering addresses the delivery vector before the payload reaches the file system. For Indian organisations where phishing emails impersonating government agencies, banks, and courier services are common delivery mechanisms, this layer provides meaningful protection.
Vulnerability Assessment and Patching
One of the most common ransomware entry points is unpatched software. The EternalBlue exploit used by WannaCry targeted a Windows SMB vulnerability that had been patched months before the attack — millions of unpatched machines were still exploitable.
Acronis Cyber Protect includes a vulnerability assessment engine that scans endpoints for missing patches across Windows operating systems and popular third-party applications (browsers, PDF readers, office software, media players). The patching module can deploy patches automatically or on an approval workflow, closing the vulnerability window that ransomware operators rely on.
Blockchain Notarization with Acronis Notary
Acronis Notary is a blockchain-based backup authentication feature built into Acronis Cyber Protect. When a backup is created, a cryptographic hash of the backup data is recorded on a public blockchain. At any point, you can verify that the backup data has not been tampered with by comparing the current hash against the blockchain record.
For Indian organisations subject to audit requirements — CA firms, healthcare providers, listed companies — Acronis Notary provides cryptographic proof that backup data is authentic and unmodified. This is relevant both for compliance purposes and for forensic investigations following an incident.
How Acronis Handles a Ransomware Attack — Step by Step
To make this concrete, here is what happens when ransomware executes on an Acronis-protected endpoint:
T+0 seconds — Ransomware payload executes. It may have arrived via a phishing email attachment, a malicious download, or lateral movement from another compromised machine on the network.
T+2 to T+8 seconds — Ransomware begins enumerating files and starting encryption. Acronis Active Protection observes the process behaviour — rapid file modifications, entropy changes, VSS interaction attempts — and accumulates confidence score data.
T+8 to T+15 seconds — Active Protection's confidence threshold is crossed. The malicious process is terminated at the OS level. Ransomware stops executing.
T+15 to T+60 seconds — Active Protection identifies files modified since the process began. It retrieves original versions from the local cache and restores them automatically. The affected files return to their pre-encryption state.
T+60 seconds onwards — An alert appears in the Acronis management console and, if configured, is sent to the administrator via email or SMS. The administrator reviews the event log, identifies the infection vector, and takes remediation steps (removing the infection source, patching the vulnerability that allowed the attack).
Net result — A small number of files were encrypted for seconds. All were automatically restored. No backup restore was required. No data was permanently lost.
This scenario assumes the attack was not sophisticated enough to disable the Acronis agent before launching ransomware — which is why keeping the Acronis agent updated and monitoring its health is part of good practice.
Acronis vs Standalone Anti-Ransomware Products
Several vendors sell dedicated anti-ransomware tools separate from their backup products. The integrated approach in Acronis Cyber Protect has meaningful advantages:
| Feature | Acronis Cyber Protect | Standalone Anti-Ransomware |
|---|---|---|
| Behavioural detection | Yes — AI/ML engine | Yes (varies by vendor) |
| Auto-rollback from local cache | Yes — integrated with backup cache | Limited — depends on product |
| Backup storage protection | Yes — backup data inaccessible to ransomware | No — external backup unprotected |
| Full backup and recovery | Yes — core feature | No — requires separate backup product |
| Vulnerability patching | Yes — built in | No |
| Web filtering | Yes — built in | No |
| Blockchain notarization | Yes — Acronis Notary | No |
| Single management console | Yes | No — multiple consoles required |
| Single agent on endpoint | Yes | No — two agents required |
Two agents running on the same endpoint create their own problems: resource contention, potential compatibility issues, and two separate update cycles to manage.
Compliance Considerations for Indian Businesses
CERT-In Incident Reporting (2022 Directive)
CERT-In's 2022 directive requires organisations to report cybersecurity incidents — including ransomware attacks — within six hours of detection. Acronis Cyber Protect's detailed event logging and audit trail supports compliance with this requirement. The console provides timestamped records of when the attack was detected, what processes were involved, which files were affected, and what actions were taken.
Information Technology Act and Data Localization
India's IT Act and the evolving data protection landscape require organisations to maintain records of security incidents and demonstrate that reasonable technical safeguards are in place. Acronis Cyber Protect's integrated security posture — backup, anti-ransomware, vulnerability management, and authentication — constitutes a defensible security architecture for compliance purposes.
Sector-Specific Requirements
Healthcare organisations face additional obligations around patient data protection (discussed in detail in our separate article on Acronis for healthcare). Financial services firms regulated by SEBI and RBI must maintain data integrity and availability under their respective frameworks. Acronis Notary's blockchain-based integrity verification is directly relevant to these requirements.
If you want to discuss compliance requirements for your specific organisation, contact our team to arrange a consultation.
How Cloudfy Deploys Acronis Ransomware Protection for Indian Businesses
As an authorised Acronis partner in India, Cloudfy Systems provides Acronis Cyber Protect services that go beyond simply delivering a licence key.
Assessment and Sizing
Before deployment, we map your environment: endpoint count, operating systems, server infrastructure (physical, VMware, Hyper-V), existing backup solutions, and current security posture. This assessment determines the correct Acronis edition (Cyber Protect Essentials, Advanced, or Backup) and the licensing model (per device or per workload).
Deployment and Configuration
We deploy the Acronis agent to all protected devices, configure backup policies (frequency, retention, destination — local, cloud, or hybrid), and tune Active Protection settings appropriate to your environment. For organisations with custom line-of-business applications, we configure exclusions where necessary to prevent false positives on legitimate software behaviour.
Backup Destination Configuration
We assist with configuring backup destinations: Acronis Cloud storage, on-premises storage targets, or hybrid configurations. For organisations with data residency requirements, we configure storage to keep backup data within India.
Staff Training and Runbooks
We provide your IT team with training on the Acronis management console, alert response procedures, and backup validation practices. We also prepare incident response runbooks — documented procedures for what to do if ransomware does breach your defences.
GST Invoice
All Acronis licensing purchased through Cloudfy Systems comes with an 18% GST invoice, making the expense claimable as ITC for GST-registered organisations.
To engage with our team for an Acronis deployment, contact us at connect@cloudfysystems.com or call +91 97600 50555.
Frequently Asked Questions
Does Acronis Active Protection work on all versions of Windows?
Acronis Active Protection is supported on Windows 7 SP1 and later, including Windows 10 and Windows 11. It is also supported on Windows Server 2008 R2 and later, including Windows Server 2022. For Mac, Acronis Cyber Protect provides backup and anti-malware capabilities, though the specific Active Protection implementation varies by macOS version. Linux endpoints are supported for backup; the Active Protection engine's full feature set is primarily designed for Windows environments where ransomware is most prevalent.
Can Acronis stop ransomware that arrives through a Remote Desktop Protocol (RDP) attack?
Acronis Active Protection's behavioural detection operates at the process level, not the network level. If an attacker gains RDP access and manually executes ransomware on the machine, Active Protection will detect and terminate the ransomware based on its file-encryption behaviour — the same way it handles any other ransomware execution. However, the RDP access itself is an authentication and network security issue that Acronis does not address. Combine Acronis with strong RDP controls (MFA, network-level authentication, firewall rules) for a complete defence.
How quickly does Acronis detect and stop ransomware?
In Acronis's published testing and typical deployments, Active Protection detects and terminates ransomware processes within 20 to 45 seconds of execution beginning. The exact timing depends on the speed of the ransomware's encryption routine and how quickly it accumulates enough behavioural signals to cross the detection threshold. Faster-encrypting ransomware variants may affect more files before detection; slower variants may be stopped after only a handful of file modifications. The auto-rollback restores affected files regardless of how many were touched.
Will Active Protection interfere with legitimate backup software or file synchronisation tools like OneDrive?
Acronis maintains an internal whitelist of known legitimate applications — backup clients, sync tools, media encoders, archive utilities — that perform bulk file operations for legitimate purposes. These applications are excluded from ransomware detection. If you use a custom or uncommon application that performs bulk file operations, you can manually add it to the exclusion list in the Acronis management console. False positives on known legitimate software are uncommon in practice.
What happens if ransomware disables the Acronis agent before launching its encryption payload?
Some sophisticated ransomware strains attempt to disable or uninstall security software before executing the encryption payload. Acronis Cyber Protect includes self-protection mechanisms that prevent the agent from being stopped or uninstalled by unauthorised processes. The agent runs as a protected Windows service that requires elevated credentials to modify. Additionally, Acronis Cloud backups that have already been committed to Acronis Cloud storage are protected regardless of what happens on the endpoint — even if the endpoint agent is completely destroyed, the cloud backup remains intact and recoverable.