The Backup Wrap-Up

Episódios

• 
  Cybersecurity Best Practices for Individuals (Encore) 03.08.2026 49min

  Cybersecurity best practices for individuals aren't complicated — they're just often ignored, and that's exactly what this encore episode digs into. This is a rerun of one of our most-engaged episodes, brought back not just because of how many people downloaded it, but because of how much of it people actually stuck around for. Curtis and Prasanna sat down with Mark Shriner, host of the SecureTalk podcast, for a wide-ranging conversation about what it actually takes to protect yourself online — no jargon, no scare tactics, just the stuff that works.Mark's path into cybersecurity started with a career pivot in 2017, and what he found was a field that goes a mile wide and a mile deep — everything from pen testing to encryption to endpoint protection. But the through-line of this conversation is that security isn't just an IT department problem anymore. It's everybody's problem, whether you're an executive with sensitive data or a parent trying to explain phishing to your kids.The conversation opens with a genuinely shocking data point: in a University of Michigan study, researchers dropped USB drives around campus, and 48% of them got plugged into a computer, some within minutes. That's the kind of thing that makes MFA (multi-factor authentication) feel less optional. Curtis shares his own MFA journey — from skeptic to evangelist — and the group breaks down why SMS-based authentication is riskier than people think, especially with SIM swapping attacks on the rise.From there, the conversation covers a lot of ground: the gift card scam that almost caught Mark's son on his third day of an internship, why "didn't expect it, don't click it" is one of the best pieces of advice you'll hear, and how phone-based social engineering is just as dangerous as email-based phishing. On the business side, Mark and Prasanna talk through device management, BYOD policies, and tools for spotting anomalous network behavior.And of course, backups get their due. Mark's advice for individuals is refreshingly simple: use a cloud-based backup service if you can, but if you can't or won't, at least use whatever's already available to you — Time Machine, an external drive, anything. The point isn't the perfect solution. It's action. Which is exactly how the episode got its name: by the end, everyone agreed the real takeaway was just do something. Don't do nothing.If you've been meaning to turn on MFA, start backing up your laptop, or just get a better handle on the basics, this is the episode to catch up on.Chapter markers: 00:00 Cold open 00:03 Meet Mark Shriner 00:10 How Mark got into cybersecurity 00:15 The University of Michigan USB drive study 00:16 Turning on MFA: Curtis's personal journey 00:19 SIM swapping and SMS authentication risks 00:23 Top security concerns for individuals 00:24 Backups, ransomware emails, and phishing basics 00:25 Being aware and pausing before you click 00:26 The gift card scam story 00:28 Phone-based scams and social engineering 00:31 Careful what you post online 00:31 Company-level MFA and security best practices 00:34 Device management and BYOD 00:35 DDI tools and data leak detection 00:43 Cybersecurity best practices for individuals: backup edition 00:45 Just do something — the summary that named the episode
• 
  Stopping Ransomware Lateral Movement Before It Spreads 27.07.2026 55min

  Ransomware lateral movement is exactly what it sounds like — once an attacker's inside your network, they start crawling around looking for more to encrypt, and stopping that crawl is often the difference between a bad day and a catastrophe. In this encore episode, part four of our seven-episode series pulling the best of the archives back into your feed, W. Curtis Preston and Prasanna Malaiyandi sit down with networking expert Tom Hollingsworth to break down exactly how attackers move once they're in, and what you can actually do about it.This one's back because listeners didn't just download it — they stuck with it, and a fair number of you came back for a second listen. That kind of engagement told us this conversation was worth surfacing again, especially with ransomware attacks as common as they are right now.Tom walks through the fundamentals of network segmentation — VLANs, air gaps, and why a "flat" network (where everything can talk to everything) is a gift to any attacker who gets in. From there the conversation moves into Zero Trust Network Architecture, what it actually takes to implement it at scale, and why flipping the switch from "allow everything" to "deny by default" is both the right move and the one that generates a thousand help desk tickets on day one. There's a good stretch on how schools, stadiums, and hotels handle network isolation differently than a typical enterprise, plus a practical rundown of incident response — locking down external access, isolating infected segments, keeping communication running when your own network is down, and why every kill switch needs to actually be wired to something.If you've ever wondered how much of this is built into your existing networking gear versus something you have to buy separately, or you just want a clearer mental model for how ransomware spreads once it's past the perimeter, this is a great one to revisit.Chapter Markers:00:00:00 - Intro and why ransomware lateral movement matters right now00:01:25 - Welcome back, meet Tom Hollingsworth00:04:06 - Why isolating the network is step one after a ransomware attack00:06:07 - Networking basics: how ransomware exploits flat networks00:09:31 - VLANs, air gaps, and network segmentation00:14:12 - Zero Trust Network Architecture explained00:19:02 - Managing zero trust at scale across teams00:25:48 - Special cases: schools, stadiums, and hotels00:34:31 - Blocking newly registered domains to stop command and control00:38:01 - Incident response: locking down the network00:42:12 - Keeping communication running during an attack00:44:54 - A real-world story: isolating infected devices00:50:01 - Building segmentation in from the start
• 
  Ransomware Response Checklist: Prevent It, Slow It, Survive It 20.07.2026 36min

  This episode is built around a ransomware response checklist — a three-part Reddit series by a security specialist who goes by snorkel42, breaking down exactly how to prevent, contain, and recover from a ransomware attack.This is an encore episode, and it's back not just because a lot of people downloaded it originally, but because so many of you listened all the way through — some of you more than once. That kind of engagement told us this one was worth bringing back.Curtis Preston and Prasanna Malaiyandi dig into snorkel42's series, which breaks the whole problem into three parts: how to stop ransomware from getting in, how to slow it down if it does, and what to actually do once you've been hit. Curtis and Prasanna go section by section — covering phishing and dropper prevention, application whitelisting, blocking lateral movement between servers, locking down RDP and SSH, honeypot files for catching intruders in the act, and building a real incident response plan before you ever need one.They also get into the messier parts most people don't talk about — what it's actually like to negotiate for a decryption key, why getting your data back isn't the end of the story, and why a ransomware attack is nothing like a normal disaster recovery scenario. Along the way, Curtis makes the case that most organizations already have the gaps this attacker needs — and that fixing them now is a lot cheaper than fixing them after the fact.Whether you're building your first incident response plan or just want to stress-test the one you've already got, this episode gives you a practical, section-by-section framework to work from.Chapter Markers:00:00 – Encore intro & episode setup00:01:37 – Show intro and banter00:06:21 – Preventing the breach: phishing, droppers, and whitelisting00:14:46 – Blocking lateral movement, RDP/SSH lockdown00:20:28 – Detecting exfiltration and honeypot files00:24:19 – What to do once you've been hit00:25:58 – Building your incident response plan00:30:43 – Decryption, ransom payments, and why it's not over yet
• 
  How to Protect Backups from Ransomware (Encore) 13.07.2026 43min

  How to protect backups from ransomware starts with a hard truth: attackers aren't just encrypting your data anymore, they're stealing it first — and no backup system on earth undoes an exfiltration. In this encore episode of The Backup Wrap-Up, Curtis and Prasanna dig into what real immutability looks like versus the marketing version, why root access quietly undermines most "immutable" storage claims, the difference between virtual and true physical air gaps, and the exact questions you should be firing at your backup vendor before you trust them with your last line of defense.This one's an encore for a reason — it was one of the most listened-to episodes in the show's history, with listeners sticking around for the full runtime and then some. That's the kind of signal that tells you it's worth a second run.Along the way, they cover S3 object lock and what actually happens if your account gets deleted or your credit card stops working, why compromised admin credentials are involved in the majority of attacks and what your vendor should be able to undo, and why bit rot — rare, but nasty when it's silent — still belongs on your checklist. If you manage backup or DR for a living, or you're just trying to figure out whether your current setup would actually hold up, this episode gives you a concrete list of questions to ask and red flags to watch for.Chapters:00:00 – Cold Open: Ransomware Is After Your Backups01:19 – Welcome & Banter05:50 – Topic Setup: Protecting Backups from Ransomware07:36 – The Extortion & Exfiltration Playbook15:25 – What Is an Air Gap?18:22 – Virtual Air Gaps27:57 – Real (Physical) Air Gaps28:12 – What Is Immutability, Really?29:23 – Bit Rot30:42 – Root Access & the Limits of Immutability32:51 – S3 Object Lock40:20 – Questions to Ask Your Backup Vendor42:31 – What Happens If You Delete Your Account?44:29 – Compromised Credentials & Worst-Case Scenarios46:41 – Final Thoughts
• 
  What Is Data Deduplication? (Encore) 06.07.2026 46min

  What is data deduplication, and why does Curtis call it the single most important development in backup over the last 30 years? In this encore episode, W. Curtis Preston and Prasanna Malaiyandi break down exactly how dedupe works, why it's not the same as compression, and why the fine print of your dedupe domain determines how much storage you actually save.This episode originally aired as part of the Backup to Basics series, and it's back because listeners couldn't get enough of it — not just downloads, but people who stuck around for the whole conversation, some more than once. That says something, because this isn't a surface-level explainer. Curtis and Prasanna get into fingerprints, dedupe indexes, and the real-world tradeoffs between file-level and block-level dedupe.You'll hear why Curtis argues that file-level dedupe isn't "real" dedupe at all, just single-instance storage wearing a costume. Then the conversation shifts to the split that shapes entire product categories: source-side dedupe versus target-side dedupe. Curtis walks through why source dedupe requires you to essentially replace your backup software, while target dedupe lets you bolt an appliance onto whatever you're already running. Prasanna pushes back on some of the assumptions along the way, which is exactly the kind of back-and-forth that made this episode stick with listeners the first time around.By the end, they even get into hybrid dedupe, a concept that splits the difference and confuses almost everyone the first time they hear about it.If you've ever wondered why your backup storage doesn't need to be 30 or 40 times the size of your production data, or you just want to finally understand what your backup vendor means when they throw around terms like "dedupe ratio," this is the episode that clears it up.Chapters:00:00 – Intro08:10 – What Is Data Deduplication?12:24 – Dedupe vs. Compression16:13 – Fingerprints and the Dedupe Index16:52 – What's a Dedupe Domain?19:48 – Is File-Level Dedupe Really Dedupe?21:53 – Source Dedupe vs. Target Dedupe28:20 – What Is Hybrid Dedupe?
• 
  The REDCap Attack that Phishing-Resistant MFA Could Have Stopped 22.06.2026 34min

  Phishing-resistant MFA could have stopped a Chinese state-sponsored threat actor from spending over a year inside North American academic and medical research networks — and we're going to tell you exactly how it happened and what you need to do about it.A group called UNC5608, tracked by Google's Threat Intelligence Group (GTIG), exploited a vulnerability unique to REDCap — a research data platform that allows multiple software versions to run simultaneously. They got in via stolen admin credentials, planted custom malware called Infinite.red directly into REDCap's upgrade process, harvested credentials for over a year, then used those credentials to log into Google Workspace as a domain admin and create fake compliance rules to silently forward sensitive research emails — military strategy, geostrategic policy, advanced tech, specific pathogens — straight to Gmail accounts they controlled. And nobody noticed for a very long time.Prasanna and I break down the full attack chain, then walk through every prevention layer that could have stopped it: inventory management, patching, password hygiene, SSO, phishing-resistant MFA, passkeys, DBSC, context-aware access, compliance rule monitoring, credential separation across security domains, and logging. We also get into what backups can and can't do for you in a long-dwell-time attack like this — and why infrastructure-as-code and truly immutable golden images matter more than you might think.If you're running any kind of research platform, academic institution, or medical network — or honestly any organization that uses Google Workspace — this one's for you.Chapters:00:00 — Intro: The attack that phishing-resistant MFA could have stopped01:03 — Show intro & woodworking banter03:26 — What is a living-off-the-land attack?04:02 — Who is UNC5608 and who did they target?05:08 — How REDCap's multi-version design was exploited06:11 — Infinite.red malware and credential harvesting09:01 — Google Workspace infiltration via fake compliance rules10:18 — The keywords they were stealing: pathogens, military strategy, and more11:50 — What could the victims have done differently?12:42 — Inventory management, patching, and legacy version removal14:00 — Why you can't trust application-level authentication alone — use SSO15:18 — Phishing-resistant MFA and why it matters16:00 — Passkeys, FIDO, and why there are zero known attacks against them17:57 — Device-bound session credentials (DBSC) and context-aware access19:38 — Monitor your compliance rules — have a compliance rule for the compliance rule20:40 — Credential separation across security domains23:00 — Get some logging — XDR, SIEM, and catching exfiltration in progress24:00 — What can backups actually do in a long-dwell-time attack?27:00 — Infrastructure-as-code and the right cyber recovery approach28:58 — Protecting your golden images with immutable storage31:59 — Wrap-up
• 
  California Election Fraud? (Pt 2) 15.06.2026 35min

  California election fraud claims are flooding social media — and most of them fall apart under basic scrutiny. In this follow-up episode, longtime San Diego County poll worker W. Curtis Preston tackles the wave of viral fraud allegations head-on, with sources so you can check his work yourself.Topics covered: the LA mayoral race "statistically impossible" surge for Nithya Raman, the AP reporting error that got blamed on fraud, claims that Spencer Pratt voters were having ballots rejected for signatures, the "gym membership card" voter ID myth, the Skid Row "paid to vote" controversy, and yes — the one claim that turned out to be true (a woman who actually did register her dog to vote).If you've seen these claims and wondered whether there's anything to them, this episode walks through the actual data, the actual law, and the actual outcomes — no spin, just the facts from someone counting the votes.Here are some sources:Los Angeles 2026 Mayor primary results:https://results.lavote.gov/#year=2026&election=4338Donald Trump got 27% of City of LA vote in 2024:https://xtown.la/2024/12/16/a-city-country-divide-more-than-70-percent-of-los-angeles-voters-picked-kamala-harris-for-president/There were 12,700 rejected ballots in all of LA county:https://perma.cc/E5Y9-NURQOrange County woman registered her dog:https://www.foxla.com/news/costa-mesa-woman-dog-voter-fraud-sentencingHeritage Foundation Voter Fraud Database:https://electionfraud.heritage.org/search
• 
  California Election Counting Explained by an Actual Poll Worker 08.06.2026 24min

  California election counting has confused — and frankly ticked off — a lot of people, and I get it. I'm W. Curtis Preston, I've worked every California election since the 2016 presidential primary, and I've managed the polls at multiple elections here in San Diego County. This episode, I'm going solo to explain exactly what's going on, why it takes so long, what the "red mirage" actually is, and why none of it is fraud. Sorry to disappoint some of you.If you've ever had a family member call you asking "what the hell is going on over there?" — this one's for you. I walk through the specific changes California made to election law, how our system compares to Florida's, why human nature is a big part of the problem, and what the chain of custody for every single ballot actually looks like from the inside. This isn't punditry. This is someone who has stood at those poll books, sealed those ballot cartons, and escorted those ballots to the DART team.Chapters:0:00 – Introduction: What the hell is going on in California?1:23 – Who I am and why I can speak to this2:12 – How California election law changed six years ago4:43 – The mail ballot window: postmark by 8 PM, received within 7 days5:09 – Vote centers vs. the old precinct model7:39 – California vs. Florida: why the laws produce such different results9:09 – Why California voters wait until the last minute14:12 – The red mirage explained: it's not fraud, it's math15:31 – Signature verification: 80,000–100,000 per day in San Diego alone16:35 – How computers count ballots — and the 1% manual audit that checks them19:11 – Chain of custody: two people, sealed cartons, tracked numbers20:17 – Debunking the "law enforcement can't observe" myth21:24 – Dead people voting? Let's talk about what's actually happening22:47 – Wrap-up
• 
  Stop 90% of Ransomware Attacks with Basic Cyber Hygiene 25.05.2026 40min

  Basic cyber hygiene — patch management, password management, and MFA — is responsible for stopping roughly 90% of the ransomware attacks that could hit your organization. This episode is the overview: what those three things are, why they matter, and what happens when you skip them.WannaCry infected over 200,000 systems worldwide. A patch existed. People just hadn't applied it. Rackspace lost an entire business line — not because the attack was sophisticated, but because a workaround gave them false confidence and they delayed a critical patch. These aren't edge cases. They're the rule.Dr. Mike Saylor (Black Swan Cybersecurity) and Prasanna Malaiyandi join me to walk through the three pillars of basic cyber hygiene. We cover patch management first — and before you can even patch, you have to know what you have. Inventory is the starting point. Then we get into passwords: why reusing them is a numbers game the bad guys always win, and why a password manager isn't optional anymore. Finally, MFA — what it is, which forms are actually worth using, and why "remember this device" is quietly defeating the whole point.This is an overview episode. We're going deeper on each pillar in three follow-up episodes. But if you're not doing these three things today, stop reading this and go do them. There's no point talking about EDR, XDR, or any other three-letter security product if you haven't nailed the basics first. It's like researching a Roth IRA when you don't have a savings account.Chapters:0:00 Intro0:59 Welcome & Introductions4:20 WannaCry: The Patch That Would Have Saved 200,000 Systems7:33 Rackspace: When a Workaround Isn't Enough12:12 Defining Basic Cyber Hygiene14:53 Why These Three Things Stop 90% of Ransomware17:54 Pillar 1: Patch Management23:55 Pillar 2: Password Management31:55 Pillar 3: MFA & Passkeys37:34 Wrap-Up & What's Next
• 
  Claude Deletes a Company — But It's Not Really Claude's Fault 18.05.2026 40min

  Claude deletes a company — and the internet immediately blamed the AI. But this story is really about backup design, credential management, and least privilege. An AI coding agent running Claude via Cursor deleted PocketOS's entire production database and all its backups in nine seconds. One bad design decision at a time, a startup built itself a disaster waiting to happen. Claude just happened to be the thing that set it off.Here's what you need to understand: the AI violated the principles it was given, and that's on Claude. But Claude never should have had access to do what it did. Credentials were sitting in a plain text YAML file. The production database and its backups lived on the same volume. No least privilege. No expiration on elevated permissions. And almost certainly, no backup recovery test — ever.In this episode, Curtis and Prasanna break down what actually went wrong with PocketOS, what Railway did to help recover the data, and what you need to do to make sure this never happens to you. Topics covered include backup isolation, the 3-2-1 rule, secrets management tools like AWS Secrets Manager and HashiCorp Vault, least privilege access, permission expiration, and credential scanning tools like TruffleHog.Chapters:0:00 — Intro: Meet the villain1:50 — Welcome and introducing "the French friend"3:48 — What Claude actually did to PocketOS7:20 — This is a backup story, not an AI story9:27 — The recovery: Railway, a weekend of chaos, and a lucky Twitter post12:31 — Your data is your responsibility — not your vendor's17:48 — Rule #1: Never store backups inside production20:37 — The real problem: credential management23:38 — Secrets management tools explained25:21 — Least privilege and why permissions need expiration dates34:59 — Finding exposed credentials with TruffleHog37:24 — Summary and takeaways
• 
  How Honeypots and Canary Files Catch Attackers Before They Strike 11.05.2026 33min

  Honeypots and canary files are two of the most underused tools in cybersecurity — and in this episode, Dr. Mike Saylor and I break down exactly how they work and why you should be using them. The short version: they're tripwires. They tell you a bad guy is poking around your network before anything gets encrypted.Mike walks through his layered security analogy, explains the three different ways organizations use honeypots — learning attacker tactics, distraction, and testing — and then we get into canary files: what makes them different from a honeypot, how they beacon home when stolen, and why clock synchronization matters more than most people think if you ever want that evidence to hold up.We also cover how to stand one up without a big budget, what tools are available, and why something is absolutely better than nothing. Plus, Mike and I have news about our new O'Reilly book, Learning Ransomware Response and Recovery.0:00 - Intro and book news1:09 - Meet the crew3:45 - Security is all about layers9:22 - What are honeypots and canary files?11:00 - Three ways honeypots work for you13:17 - Real-world examples: bait cars and glitter bombs15:20 - Making your honeypot convincing19:11 - Honeypot tools and options21:13 - Something is better than nothing24:10 - Monitoring and notifications25:05 - Canary files explained27:03 - How canary files beacon and track attackers28:03 - Don't forget to sync your clocks29:05 - Final thoughts
• 
  Network Segmentation to Prevent Ransomware: What the UCSF Attack Taught Us 04.05.2026 47min

  Network segmentation to prevent ransomware isn't just a nice-to-have — the UCSF ransomware attack proves it's what separates a contained incident from a catastrophe. UCSF got hit. Their segmented network kept the damage from spreading across their entire operation. That's the difference we're talking about in this episode.Dr. Mike Saylor — my co-author on Learning Ransomware Response and Recovery — joins me and Prasanna to break down exactly how network segmentation works, why it matters for ransomware defense, and how to start doing it without breaking everything in the process. (Not that I've ever done that. Much.)We cover what segmentation actually is, how VLANs make it manageable, the "need to talk" principle, and where microsegmentation fits in — and when it becomes overkill. We also get into the complexity trap: more rules and more layers don't automatically mean more protection. Sometimes they mean nobody can troubleshoot anything when the house is on fire.If you're an IT admin trying to make the case for better network architecture, or you just want to understand what would actually stop ransomware from ripping through your environment, this is the episode.Chapters:00:00:00 — Intro00:01:40 — Welcome & Guest Introductions00:05:17 — Case Study: UCSF Ransomware Attack00:08:13 — What Is Network Segmentation?00:12:32 — VLANs Explained00:19:50 — The Need to Talk Principle00:30:54 — Complexity vs. Security00:31:09 — Microsegmentation00:38:55 — Action Items: Where to Start00:42:05 — Monitoring VLAN Traffic
• 
  Stop Using VSS as a Backup Before Ransomware Deletes Your Shadow Copies 27.04.2026 36min

  Stop Using VSS as a Backup Before Ransomware Deletes Your Shadow CopiesRansomware deletes shadow copies using your own built-in Windows tools against you — and if VSS was your backup plan, you just found out the hard way that it wasn't. In this episode, W. Curtis Preston (Mr. Backup), Prasanna Malaiyandi, and Dr. Mike Saylor break down exactly what shadow copies are, why they don't qualify as a real backup, and how attackers are weaponizing vssadmin to wipe your recovery options before you even know you're under attack.If you've got Windows systems and you've been thinking "eh, we've got shadow copies," this episode is for you. We cover the history of VSS — what it was actually designed for, why it became a crutch, and why using it as your primary backup strategy is a bad idea on multiple levels. Performance, the 3-2-1 rule, and the fact that one attacker with admin rights can delete every single copy in seconds. We also get into the living off the land angle: how attackers do recon on your shadow copies, how they use them to scope out valuable data before going full ransomware, and what you can actually do to detect and respond to this behavior using EDR tools.The bottom line: VSS is a great tool. It was just never meant to be your backup. Get a real one.Chapters:0:00 — Intro1:39 — Welcome & Book Talk3:26 — What Are Shadow Copies and Why Do People Use Them as Backups?9:14 — Performance Problems with VSS as a Backup10:19 — Living Off the Land: How Ransomware Uses VSS Against You12:36 — Can You Monitor or Lock Down VSS Admin?14:26 — Why Shadow Copies Fail the 3-2-1 Rule (They're Not a Backup)18:01 — How to Protect Yourself: Configuring Your EDR21:31 — The Local Admin Problem and Security Culture27:00 — Virtualization, Snapshots, and Shadow Copies29:00 — Final Thoughts: Just Don't Do That
• 
  Ransomware Sanctions, OFAC, and the Lazarus Group: A Real Case Study 20.04.2026 36min

  Ransomware sanctions are something most companies never think about — until they're staring down a ransom demand from a group the US government has already put on a sanctions list. In this episode, Dr. Mike Saylor walks us through a real incident involving a construction company, hundreds of millions in active contracts, and the Lazarus Group — a North Korean state-sponsored threat actor. Before that company could pay a single dollar in ransom, they had to figure out whether doing so would trigger federal penalties that dwarfed the ransom itself. We're talking fines of 10x to 100x the payment amount, and in some jurisdictions, jail time.This is one of those episodes where the story alone is worth your time. Mike was in the room for this incident, negotiating directly with the Lazarus Group over a weekend — and yes, it turns out North Korean cybercriminals have a surprisingly functional help desk. But beyond the story, there's real actionable information here about OFAC (the Office of Foreign Asset Control), how the US Treasury tracks Bitcoin wallets to identify sanctioned actors, and what you actually need to do the moment ransomware hits your organization.We also get into why paying a ransom paints a target on your back — 70% of companies that pay get hit again within six months — and why immutable backups are the only thing that truly keeps you out of this situation.Chapters:0:00 Intro1:31 Meet the Guests: Curtis, Prasanna, and Dr. Mike Saylor4:10 Case Study: A Construction Company and the Lazarus Group6:34 Are These Bad Guys Sanctioned? Introducing OFAC8:05 Why Ransomware Funds Terrorism, Drug Trafficking, and Worse11:00 Sanctions Penalties: Fines That Can Put You Out of Business12:24 Colonial Pipeline and Exceptions for Critical Infrastructure13:26 How the Government Tracks Bitcoin Wallets16:27 Global Sanctions: UK and Australia Have Their Own Rules18:31 Pay Once, Pay Again: The 70% Re-Attack Rate20:43 Proof of Life: Don't Pay Without It23:38 What To Do When You Get Hit: The Right Order of Operations25:17 Immutable Backups: The Only Real Answer27:07 How the Construction Company's Backups Got Wiped33:07 Build Your Team Before the Bad Day: FBI InfraGard and More
• 
  The Real Cost of a Ransomware Attack: The Ransom Is the Least of Your Problems 13.04.2026 46min

  The cost of a ransomware attack goes way beyond the ransom itself — and most organizations don't find that out until it's too late. In this episode of The Backup Wrap-up, W. Curtis Preston (Mr. Backup) and co-host Prasanna Malaiyandi sit down with Dr. Mike Saylor of Black Swan Cybersecurity to walk through every category of cost that hits when ransomware strikes.The case that kicks everything off: UVM Health Network, October 2020. Over 1,300 servers encrypted, staff forced back to paper records, patient care disrupted for weeks. Total tab? Over $63 million — and they never paid the ransom.From there, we go category by category: people costs (overtime, third-party IR firms, emergency hardware), lost business revenue, regulatory fines, reputational damage that doesn't wash off, staff burnout and resignations, supply chain chaos, payment processor shutdowns, and cyber insurance fine print that can leave you holding the bag even when you think you're covered.We also cover what you should be doing right now — before any of this happens to you. Starting with a Business Impact Analysis, which Mike argues most small-to-medium businesses can knock out in one to three weeks. Knowing what a downed system costs you per hour is exactly the information that gets you budget from leadership and a plan that actually works when the feces hits the rotary oscillator.Chapters:00:01:44 - Intro & Welcome00:03:45 - Case Study: UVM Health Network ($63M, 1,300 Servers Down)00:07:12 - People Costs: Overtime, Staffing & Third-Party IR Firms00:10:01 - The Odds Are Damn Near 100% — Set Up Your IR Relationship Now00:13:00 - Hardware Costs & Emergency Spending00:14:05 - Lost Business Revenue (Current and Future)00:15:14 - The Stat That Should Scare You: Over 50% Don't Survive00:16:38 - Regulatory Fines (GDPR, California & More)00:19:32 - Reputational Damage: Your Customers Never Forget00:21:28 - Staff Burnout, Exhaustion & Resignations00:22:40 - Supply Chain Disruption & Credit Rating Impact00:24:07 - Payment Processor Shutdown (Real Case: Dental Practice)00:26:00 - Cyber Insurance: Fine Print, Claim Denials & Premium Spikes00:27:52 - Post-Attack Process Remediation Costs00:29:36 - Business Impact Analysis: Why You Need One Before It Happens00:35:00 - Action Items00:39:41 - Recovery Prioritization & Recovery Point Objectives00:44:43 - Wrap
• 
  How Polymorphic Malware Evades Detection — And What to Do About It 06.04.2026 29min

  Polymorphic malware is the kind of threat that changes its own code — its signature, its behavior, even the command-and-control server it reports to — specifically so your antivirus can't catch it. In this episode, Dr. Mike Saylor of Black Swan Cybersecurity joins Prasanna and me to break down exactly how this works, why signature-based detection keeps losing the race, and what defenders actually need to do differently.Mike walks us through ViraLock, one of the most well-known early examples of polymorphic malware, and explains the gap between infection and detection that attackers exploit. We also get into the difference between polymorphic and metamorphic malware — and metamorphic is a lot scarier. Then we cover waterhole attacks, a red team story that will make you rethink how fast attackers can own a network, and what behavioral detection looks like when it's actually working.If you thought keeping your antivirus updated was enough, this episode is going to change your mind.Chapters:00:00:00 – Intro01:35 – Meet the guests: Prasanna Malaiyandi and Dr. Mike Saylor02:58 – What is polymorphic malware? The ViraLock story05:52 – How polymorphic code changes its own signature10:04 – Disguised executables and the human factor12:23 – Polymorphic vs. static malware: what's the real difference?14:15 – Metamorphic malware: nation-state-level scary16:01 – The Frankenstein virus: a conceptual metamorphic example16:52 – Waterhole attacks: infecting the shared file everyone downloads18:32 – How polymorphic malware stays alive: the red team story21:28 – Behavioral detection and baselining: how you actually fight back26:57 – Risk-based defense: protect what matters most
• 
  Emergency Episode: The PyPI Software Supply Chain Attack You Need to Know About 26.03.2026 55min

  A PyPI software supply chain attack hit LiteLLM — a library pulled into developer environments 97 million times a month — and if you use it, you may already be compromised. This wasn't a fake package or a typo-squatting trick. Attackers stole real credentials, published malicious code as the real thing, and walked out with SSH keys, cloud credentials, Kubernetes tokens, API keys, and more — all encrypted and sent home before anyone knew what happened.I'm doing something I've never done before: an emergency episode, recorded and published immediately because this is that serious. I brought in Dr. Mike Saylor, co-author of our book Learning Ransomware Response and Recovery, and my co-host Prasanna Malaiyandi to break down exactly what happened, how to find out if you were hit, and what you need to do to protect yourself going forward.We open with a story from 1982 that perfectly captures what this attack really is — getting poisoned by something you trusted completely. That framing matters. This wasn't a failure of the library. It was a failure of the supply chain. And it can happen again.Chapters:00:00:00 - Intro: Why this is an emergency episode00:01:35 - Meet the guests: Dr. Mike Saylor and Prasanna Malaiyandi00:02:31 - The Tylenol poisoning analogy and what it means for software supply chains00:05:51 - What LiteLLM is and what the malware actually did to your environment00:09:04 - Dependencies explained: why you're affected even if you didn't install LiteLLM directly00:12:24 - How to find out if you were hit: the first things to check right now00:14:23 - IOCs and TTPs: what to look for in your logs and on your systems00:19:07 - Network indicators: unusual traffic and what it tells you00:22:12 - How security teams can find out if developers installed it without telling anyone00:30:38 - Action items for the future: inventory, pinning, and hash verification00:36:55 - Sandboxing new downloads before they touch your environment00:37:59 - Immutable backups: why this attack makes the case for them00:40:33 - Modern authentication: MFA, its limits, and why passkeys matter00:46:53 - Where to get threat intel so you hear about attacks like this faster00:53:23 - Wrap-upIf you installed or upgraded LiteLLM on or after March 24, 2026 without a pinned version, stop what you're doing and listen to this episode first.The story:https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/ https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/ https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/ https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaignhttps://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama/ https://www.upwind.io/feed/litellm-pypi-supply-chain-attack-malicious-release https://docs.litellm.ai/blog/security-update-march-2026 https://www.helpnetsecurity.com/2026/03/25/teampcp-supply-chain-attacks/ https://www.darktrace.com/resources/the-cisos-guide-to-cyber-aihttps://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/Resources:https://www.stopransomware.comhttps://www.cisa.govhttps://www.cve.org/
• 
  Fileless Malware: The Attack That Lives in Memory 23.03.2026 32min

  Fileless malware is one of the most dangerous attack types out there — it never writes to your hard drive, lives entirely in RAM, and can steal your credentials before your antivirus has any idea it's there. In this episode, I bring in Dr. Mike Saylor — my co-author on Learning Ransomware Response & Recovery — to break down exactly how this attack works, why it's so hard to detect, and what you can actually do to protect yourself.Mike walks us through how fileless malware hides in memory, how bad guys maintain their foothold even after a reboot by modifying registry keys or rewriting the operating system itself, and why the ArcGIS attack is a perfect real-world example — attackers sitting undetected inside a network for two years. We also get into MFA, specifically why a lot of MFA setups are done wrong, why passkeys are the better answer, and when it's time to bring in an EDR or XDR tool.Fair warning: the action items here are a bit more advanced than our usual stuff. Think of this as the 401k conversation — don't have it before you've built your emergency fund. But this is stuff you absolutely need to know.00:01:26 - Welcome & intro00:04:43 - What is fileless malware?00:09:16 - How fileless malware achieves persistence (ArcGIS case study)00:15:02 - Can fileless malware spread beyond one machine?00:16:43 - Defending yourself: MFA done right00:20:38 - Why passkeys beat MFA00:23:00 - EDR and XDR explained00:28:03 - How modern EDR tools detect fileless malware00:30:01 - Wrap-up and action items
• 
  Living Off the Land Attack: Hackers Using Your Own Tools Against You 16.03.2026 46min

  A living off the land attack is one of the sneakiest techniques in a ransomware operator's playbook — and in this episode, Dr. Mike Saylor breaks down exactly what it is, how it works, and what your organization can actually do about it.Instead of bringing their own tools into your environment (which might trip your alarms), attackers just use what's already there. PowerShell. WMI. RDP. The same tools your admins run every single day. To your monitoring systems, it looks completely normal. That's the whole point.Mike and Curtis cover why attackers prefer your tools over their own, how recon can quietly run for 30 to 90 days before the attack goes loud, and what defenders can actually do about it — removing admin privileges, system hardening, golden images, application whitelisting, and free tools like Nmap and Wireshark. There's also a match.com story involving organized crime and a wooden casket on someone's front porch that you really don't want to miss.0:00 - Intro1:21 - Welcome and Book Announcement3:28 - What Is a Living Off the Land Attack?5:38 - Real-World Example: Conti Ransomware and WMI8:12 - Why Attackers Use Your Tools Instead of Their Own13:05 - Admin Privileges: Best Practice vs. Reality17:31 - The Louvre Heist Analogy20:08 - Recon Phase: Low and Slow24:16 - What Defenders Can Do25:55 - RDP and Remote Access29:48 - The Recon Timeline: 30-90 Days30:48 - PowerShell and System Hardening34:10 - Network Discovery Tools (Nmap and Wireshark)37:37 - Application Whitelisting and Geo IP Blocking42:08 - Action Items and Wrap-Up
• 
  New Research Exposes Password Manager Vulnerabilities in LastPass, Bitwarden & Dashlane 09.03.2026 43min

  Password manager vulnerabilities aren't just about bad code — and a new research paper out of Zurich just proved it. Researchers analyzed three of the most popular password managers and found fundamental design flaws baked into the very architecture that's supposed to keep your credentials safe. Curtis and Prasanna break it all down and tell you what to do about it.If you've ever been that person who asks "but what if the password manager gets hacked?" — this episode is for you. And if you haven't been asking that question, you probably should start. A research team looked at LastPass, Bitwarden, and Dashlane — products with a combined 60 million users representing roughly 23% of the password manager market — and what they found wasn't sloppy programming. It was something harder to fix: architectural problems at the core of how encrypted vaults work.Curtis walks through how the zero-knowledge encryption model works, why the vault recovery process creates an inherent trust problem, and why the researchers were able to exploit that trust by impersonating the server during vault recovery. Prasanna adds another layer — the field-level encryption issues inside the vaults themselves, where there's no strong verification that data hasn't been manipulated. It's not theoretical. It's a real attack surface.The good news? Curtis still believes password managers are the right tool for today — better than sticky notes on a monitor (yes, he saw that in real life) and better than reusing passwords. But he's also clear that passkeys are the right direction for the future, even if the current implementation is still a little rough around the edges.https://eprint.iacr.org/2026/058.pdfhttps://www.theregister.com/2026/02/16/password_managers/https://www.forbes.com/sites/daveywinder/2026/01/23/lastpass-issues-critical-warning-for-users---password-attacks-underway/