Backmydata
BackMyData is a ransomware strain identified as a variant of the Phobos ransomware family. It was used in the February 2024 attacks on Romanian hospitals via the Hipocrate/Hippocrates healthcare management system after attackers breached Bucharest-based software provider RSC. The campaign disrupted more than 100 hospitals across Romania, with at least 25 hospitals confirmed to have encrypted data and many others taking systems offline as a precaution. Impacted healthcare organizations reverted to paper-based workflows for admissions, prescriptions, medical records, lab requests, radiology, medicines, supplies, payroll, pharmacy logistics, and test results. Romanian authorities stated there was no evidence of patient data theft at the time of reporting, and most affected hospitals reportedly had recent backups. The attackers demanded ransom in bitcoin; one report cited a demand of 3.5 BTC, and the ransom note reportedly did not identify the ransomware operation by name.
Observed technical behavior includes encrypted configuration data protected with a hard-coded AES key, use of an embedded RSA public key to wrap per-file AES-256 keys, and file encryption that fully encrypts smaller files and partially encrypts files larger than 1.5 MB. Encrypted files receive the .backmydata extension together with the volume serial number and attacker email address, and contain an unencrypted 16-byte IV, an RSA-encrypted AES key, and a 6-byte marker value DD F9 CC F5 B3 44. The malware drops ransom notes named info.txt and info.hta and instructs victims to contact the attacker via email or Session messenger.
BackMyData establishes persistence by copying itself to %AppData%\Local, creating Run registry entries under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and copying itself to C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup<Executable name>. It deletes Volume Shadow Copies, disables automatic repair, deletes the backup catalog, and disables the Windows firewall. It enables SeDebugPrivilege, kills processes including sqlservr.exe, oracle.exe, mysqld.exe, outlook.exe, winword.exe, excel.exe, thunderbird.exe, and steam.exe to unlock files, enumerates logical drives and network resources, probes hosts over TCP/445, and encrypts local drives and network shares using multiple worker threads. It avoids systems with Cyrillic locale indicators and skips selected files and directories including info.hta, info.txt, boot.ini, bootfont.bin, ntldr, ntdetect.com, io.sys, backm, C:\WINDOWS, and C:\ProgramData\microsoft\windows\caches. One analyzed sample was identified by SHA-256 396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
4 techniques
Privilege Escalation
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
The DuplicateTokenEx API is utilized to create a new access token that duplicates the token mentioned above... The ransomware spawns itself running in the security context of the newly created token.
Stealth
4 techniques
Stealth
The unencrypted file is overwritten with zeros and deleted afterwards.
The DuplicateTokenEx API is utilized to create a new access token... The ransomware spawns itself running in the security context of the newly created token.
Discovery
5 techniques
Discovery
The malware takes a snapshot of all processes in the system... The processes are enumerated using the Process32FirstW and Process32NextW APIs.
The malware extracts the major and minor version numbers of the operating system using the GetVersion method.
The files are enumerated using the FindFirstFileW and FindNextFileW methods.
Lateral Movement
2 techniques
Lateral Movement
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware used to infect hospitals, encrypt files, and demand payment in bitcoin.
Ransomware that encrypts files and demands payment in bitcoin.
Ransomware group that targets healthcare organizations, encrypting systems and disrupting operations.
Backmydata is a ransomware strain that disrupted healthcare management systems in Romania, forcing hospitals to take systems offline.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.