Veeam Backup & Replication v13 – Comprehensive Malware Detection and Ransomware Defense

Introduction

Version v13 marks a significant leap in malware detection capabilities. Compared to the real-time detection already available in the v12 era, v13 brings qualitative improvements in threat response mechanisms, platform coverage, and intelligent capabilities.

The latest Veeam Backup & Replication v13 takes data protection to the next level with a built-in malware detection engine, providing deeper visibility and faster response to cyber threats.

This article explores the comprehensive malware detection features in Veeam v13, how they integrate with existing ransomware defense mechanisms, and practical tips to maximize your backup security.

 In my previous articles, I've detailed v12's ransomware attack detection principles and configuration methods. Today, we'll build on that foundation to examine v13's key upgrades.

👉 Related reading: VBR Security Feature Deep Dive – Malware and Ransomware Protection

v12 Detection Capability Review: Separation of Detection and Response

During the v12 era, Veeam's malware detection primarily relied on two mechanisms:

• Inline Entropy Scan - Real-time analysis of data block entropy changes during backup to detect encryption behavior
• Index Scan - Analysis of abnormal behavior patterns through file system indexing

The characteristic of these two features was that detection was separate from handling - the system could detect threats in real-time, but the response process required manual intervention. In practical use of v12, this mechanism had several clear limitations:

• Low response automation: After detecting suspicious activity, it mainly relied on administrators to handle it manually
• Limited platform support: Detection capabilities were primarily focused on Windows environments
• Insufficient depth analysis: Lacked further threat analysis capabilities after detecting threats

I believe v13 shows substantial progress in this detection capability, beginning the evolution from "detection" to "intelligent response."

What’s New in Veeam v13 Malware Detection

In VBR v13, malware detection is now an integral part of every backup and recovery workflow.

Key Enhancements Include:

• Real-time malware scanning during backup and restore operations.

• Integration with antivirus and EDR tools for automated threat analysis.

• Anomaly detection that flags unusual changes in data patterns.

• Centralized reporting dashboard to monitor all alerts from one console.

📖 Reference: Veeam v13 Release Notes

V13 Active Response Mechanism: From Detection to Automatic Protection

Proactive investigation: Enhanced threat verification methods

The most important improvement in v13 is the introduction of active backup scanning mechanism. The core concept of this feature is: once suspicious activity is detected during backup, the system immediately triggers more in-depth signature scanning rather than waiting for users to make additional manual judgments.

Software settings:

1. Open the VBR console, go to the top-left Hamburger menu → Malware Detection Setting
2. In the original Signature Detection settings, v13 adds new Proactive investigation options:

The first checkbox enables the active scanning mechanism, while the second option provides further processing, allowing the system to automatically resolve malware incidents based on scan results.

Actual usage effects:

In a simulated ransomware attack test environment, when backup jobs detected large-scale file encryption:

• v12 detected malware: Marked backup as Suspicious, sent alerts, waited for administrator handling
• v13 detected malware: Immediately triggered signature scanning, after confirming threats directly marked as Infected or if no threat was found, re-marked as Clean.

During the v12 era, I frequently heard from customers who discovered Veeam reporting backup archives as Suspicious status but didn't know how to proceed or what was happening. Now with v13's options, we can immediately trigger detection through Veeam without waiting, truly identifying whether problems exist.

Cross-Platform Unified Protection: Linux and Cloud Environments Are No Longer Forgotten Corners

Comprehensive Support for Linux Environments

Another breakthrough in v13 is the full coverage of malware detection capabilities on the Linux platform, which I consider an important part of comprehensive Linux support.

Linux Detection Capabilities:

1. Suspicious file system activity analysis - Same detection logic as the Windows platform
2. Veeam Threat Hunter scanning - Signature-based malware detection
3. YARA rule support - Custom threat detection rules

Key Configuration Points for Practical Use:

For malware detection in Linux environments, pay attention to several special configurations:

1. File system selection: Special characteristics of certain file systems (like Btrfs, ZFS) may affect detection accuracy
2. Permission management: Ensure backup agents have sufficient permissions to read all files requiring detection
3. Performance impact: In resource-constrained Linux environments, detection frequency adjustments may be necessary

Specific Operational Steps:

For agent-based Linux backups, malware detection configuration is basically consistent with Windows environments. It's primarily configured globally through the VBR console's Malware Detection settings, then enabled in specific backup jobs.

Security Protection for Cloud Backups

As more users adopt public cloud, cloud environment security becomes crucial. v13 extends malware detection capabilities to cloud backups:

Supported Cloud Platforms:

• Veeam Backup for Microsoft Azure
• Veeam Backup for AWS
• Veeam Backup for Google Cloud

Usage and configuration, including supported capabilities, are essentially identical to Linux and won't be repeated here.

Antivirus Integration for Linux Mount Servers

v13 supports Linux Server as a Mount Server - this is a fully functional Mount Server. The Secure Restore and Security Scan capabilities available on Windows Mount Servers have been extended to Linux Mount Servers, with equal support for Veeam Threat Hunter signature scanning:

Announced Supported Antivirus Solutions for Linux Versions:

• ClamAV - Open source and free, suitable for budget-conscious environments
• ESET - Commercial solution with strong detection capabilities
• Sophos - Enterprise-grade protection with a user-friendly management interface

Configuration Example:

Using ClamAV as an example, you need to install ClamAV on the Linux mount server, then select the appropriate Linux server in the VBR console's Backup Infrastructure → Mount Servers. During use, both scan backup and Secure restore can call the antivirus software for scanning.

Summary and Recommendations

v13's malware detection capabilities represent a qualitative leap from passive detection to active protection. Several recommendations for actual deployment:

• Gradual implementation: First, validate all new features in test environments before gradually rolling out to production
• Performance monitoring: Closely monitor the impact of new features on backup performance, making adjustments when necessary
• Strategy optimization: Customize detection strategies according to business characteristics, avoiding one-size-fits-all configurations
• Regular drills: Conduct regular malware detection drills to ensure response process effectiveness

These improvements in v13 show us the new positioning of backup systems in overall security architecture - no longer just passive data protectors, but active participants in security defenses. In practical use, proper configuration of these features can significantly enhance an organization's ability to counter modern threats like ransomware attacks.

The Veeam Backup & Replication v13 Malware Detection feature marks a major leap in data protection and cyber resilience.

By combining real-time malware scanning, immutable backups, and AI-powered anomaly detection, Veeam v13 provides the strongest defense yet against ransomware and data corruption.

Stay ahead of cyber threats — upgrade to VBR v13 and protect your backups with confidence.

Veeam Backup Security Deep Dive – How VBR Protects Against Malware and Ransomware

Introduction

Cyber threats like ransomware and malware are now targeting backup repositories, making backup security more critical than ever.
In this article, we take a deep dive into Veeam Backup & Replication (VBR) security features, exploring how Veeam protects your data with immutability, anomaly detection, and layered defense mechanisms.

In addition to online scanning of backup data streams, VBR now also supports secondary scanning of backed-up data. Version 12.1 features two major scanning engines: one uses antivirus software on the Mount Server, and the other uses YARA.

YARA Scanning Engine Tool

YARA (full name: Yet Another Recursive Acronym).

Official website link: https://yara.readthedocs.io/en/latest/.

GitHub repository link: https://github.com/virustotal/yara/.

YARA is typically used to help security experts and researchers identify and classify malware. It is primarily used for malware research and detection. It can scan for text or binary code patterns.

The YARA tool generally consists of two parts. One part is the YARA scanning engine itself, which can be installed on various platforms. The other part is YARA rules, which are matching rules written by users based on actual needs. When using YARA, the simple logic is that the YARA engine calls YARA rules to scan the corresponding content that needs to be scanned and outputs the scan results.

In VDP v12.1, the YARA tool was added. Backup and security administrators can directly call pre-written YARA rules from the VBR console to scan backup archives. There is no need to manually set up a YARA runtime environment yourself.

YARA Rules

Regarding YARA rules, the syntax is actually very simple. You can refer to the official documentation at https://yara.readthedocs.io/en/stable/writingrules.html. Related rule templates can be found on GitHub at https://github.com/Yara-Rules/rules.

VBR comes with three classic YARA rule templates built in, which can serve as references for writing.

Of course, it's not so troublesome now. Various GPTs can help us easily write a YARA rule, for example:

How YARA Scanning Works

Save the content generated by Chat GPT above into a file ending with .yar or .yara, then place it in the C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules directory. VBR will automatically recognize these rules.

After starting the scan, VBR will mount the backup archive to the Mount Server, then use the YARA engine on the Mount Server to load the selected YARA rules for scanning.

Of course, since this scanning is for text and binary patterns, it is not limited to malicious code scanning. In fact, it can scan for any key information we want to find.

Mount Server Antivirus Software Scanning

Starting with VBR v10, antivirus software scanning was built into the Secure Restore feature. VBR calls the antivirus software on the Mount Server to scan backup archives. In v12.1, this feature has been integrated into Scan Backup, and the built-in supported antivirus software has been further expanded.

Antivirus Software Configuration

In v12.1, six antivirus engines are built-in: Symantec Protection Engine, ESET, Windows Defender, Kaspersky Security, Bitdefender Endpoint Security Tools, and Trellix (formerly the well-known McAfee).

Besides these six software options, if other antivirus software needs to be used, Veeam also supports configuring other antivirus software via the AntivirusInfos.xml file. Simply modify the XML file in the %ProgramFiles%\Common Files\Veeam\Backup and Replication\Mount Service directory on the Mount Server and use CLI commands to call the corresponding antivirus software. For more detailed XML configuration methods, refer to the official website's detailed XML syntax attribute description: https://helpcenter.veeam.com/docs/backup/vsphere/av_scan_xml.html?ver=120.

Configuration Methods

On VBR, there are multiple ways to initiate a scan.

1. Select a supported backup archive, right-click, or choose the Scan Backup button on the toolbar to activate the antivirus engine scan or YARA scan dialog.

After starting Scan Backup, a scan dialog will open. At this point, these two engines can be used to perform security scans on the entire backup chain using three different scanning methods.

2. In various whole-machine or disk recovery Secure Restore steps, check the antivirus engine scan or YARA scan option.

3. In SureBackup jobs, check the antivirus engine scan or YARA scan option.

Viewing Scan Results

If the scan results match the content being searched for, VBR will mark the scanned backup archive as Infected status, indicating that malware has been detected.

Complete scan archives are recorded in this directory on VBR: C:\ProgramData\Veeam\Backup\FLRSessions\Windows\FLR__<machinename>_\Antivirus

As with the online malware attack analysis mentioned earlier, detailed scan statuses are also recorded in VBR's History. Scan results can be looked up in History.

The above are some of the new backup archive scanning and inspection methods added in VDP v12.1. They help administrators avoid secondary infections after issues occur and ensure that the restored data is a clean system archive.

Key Veeam Security Features for Malware Defense

🔒 Immutable Backups

Veeam’s immutable backup repositories prevent any modification or deletion of backup data, even by administrators.

• Available for Linux hardened repositories and S3 object storage.

• Ensures ransomware resilience with write-once, read-many (WORM) protection.

📖 Reference: Veeam Immutability Guide

🧠 Malware and Anomaly Detection

Newer Veeam releases include malware scanning integration and anomaly detection capabilities:

• Automatically scans backups for malicious patterns.

• Detects unusual changes in file size or data entropy.

• Integrates with third-party antivirus tools for added security.

👥 Role-Based Access Control (RBAC)

Minimize insider threats with granular permissions:

• Assign user roles like Backup Operator, Restore Operator, or Auditor.

• Restrict critical actions (e.g., deletion, encryption changes).

• Log every activity for audit traceability.

🧩 Multi-Factor Authentication (MFA)

Add an extra layer of protection by enabling MFA in Veeam Enterprise Manager or console access.
It prevents unauthorized login even if credentials are compromised.

👉 Related reading: Making VBR Login More Secure – Complete Guide

Conclusion

The VBR security features in Veeam Backup & Replication provide an advanced defense framework against malware and ransomware.
From immutable backups to anomaly detection and RBAC, Veeam empowers businesses to secure their data and guarantee safe, reliable recovery when disaster strikes.

Protecting your backups isn’t optional—it’s a core part of modern cybersecurity.

Veeam Agent Free and SSH Service – Secure Backup Access and Configuration Guide

introduction

Data protection is more than just backups; it's about the last line of defense for enterprise security. Veeam incorporates security into every detail of its products through a zero-trust design philosophy.

In any system, obtaining account credentials is the starting point for hacker attacks, and backup systems are no exception. Storing and managing accounts carries certain security risks, so when designing and configuring systems, reducing unnecessary automatic remembering and saving of account information is a crucial security measure. In backup solutions, Veeam Agent for Linux introduces passwordless account management, which significantly enhances system security. This approach eliminates the need to store account information within the system, effectively reducing potential security vulnerabilities and data breach risks. This passwordless management mechanism not only elevates backup security but also simplifies administrator workflows. For specific systems, it can even avoid using the SSH management protocol, making the overall system more secure and reliable.

When managing remote backups in Linux and Windows environments, enabling SSH service for Veeam Agent Free ensures secure communication and control. This method allows IT administrators to perform automated, remote, and encrypted backup operations without exposing systems to unnecessary risks.

This guide explains how to configure SSH access in Veeam Agent Free, why it matters, and best practices for maintaining backup security.

Additionally, for environments where bastion hosts manage root passwords, this deployment method can adapt to constantly changing account credentials, eliminating the need to modify stored passwords in the backup system.

How It Works

Before deploying Veeam Agent for Linux, administrators first install Veeam's deployment service package and a temporary certificate on the Linux machine. With this service package in place, when VBR initiates an Agent push/management operation, it detects this component on the Linux system. After establishing a connection with this component, it checks the necessary certificates. If it's a temporary certificate, VBR will issue a formal certificate to replace the current temporary one. Thereafter, VBR will use this valid certificate to communicate with the Linux machine, managing and installing the relevant Agent components. This entire process completely eliminates the need to enter the Linux machine's administrator username and password on the backup server.

Step-by-Step Guide

Now, follow me step-by-step to see how to use this feature.

Step 1: 

First, you need to export the pre-installation software package and temporary certificate from VBR using the following PowerShell command:

 
Generate-VBRBackupServerDeployerKit -ExportPath "C:\Users\Administrator\Documents"

Click the hamburger icon (three horizontal lines) in the top left corner of the VBR server, find the PowerShell menu under Console, enter the above command, and you will obtain this Deployer Kit.

In the exported directory, you will see the files:

• client-cert.pem
• server-cert.p12
• veeamdeployment_12.2.0.334_amd64.deb
• veeamdeployment-12.2.0.334-1.x86_64.rpm
• VeeamDeploymentSvc.mmp

Among them, the rpm package is for Red Hat-based systems, and the deb package is for Debian-based systems. Depending on the system, you need to copy client-cert.pem, server-cert.p12, and either the rpm or deb package to the target Linux machine.

Step 2: 

Run the command to install the rpm package:

 
yum install veeamdeployment-12.2.0.334-1.x86_64.rpm

Step 3: 

Then run the command to install the certificate:

 
/opt/veeam/deployment/veeamdeploymentsvc --install-server-certificate server-cert.p12
/opt/veeam/deployment/veeamdeploymentsvc --install-certificate client-cert.pem
/opt/veeam/deployment/veeamdeploymentsvc --restart

Step 4: 

Return to the VBR console and create a protection group. In the protection group creation wizard, when adding a Linux host, select "Connect using certificate-based authentication." After adding, you can use the "Test Now" button to check connectivity. When using certificate-based authentication mode, VBR will no longer require any SSH service to deploy Veeam Agent for Linux.

Step 5: 

Once everything is normal, you can complete the creation of the Protection Group and push the Agent as usual. During the push process, VBR will update the temporary certificate on the target server, replacing it with a formal communication certificate, and install the Transport service.

Benefits of Using SSH with Veeam Agent Free:

• Secure data transfer and command execution.

• Allows remote management for Linux backups.

• Integrates easily with Veeam Backup & Replication for central control.

• Supports key-based authentication, reducing password risks.

👉 Related reading: Secure Veeam Backup & Replication Login – Complete Guide

That's all for this security tip on Linux Agent management. I hope it helps with your IT system's security. In the next issue, I'll show you how to use passwordless management for Windows systems.

 How to Back Up Your iPhone to a Computer – Complete Guide for Windows and Mac Users

Introduction

Losing your phone can be stressful—but losing your photos, contacts, and messages is even worse. The best way to protect your personal data is to back up your iPhone to a computer regularly.

Whether you use a Windows PC or a Mac, this guide will show you how to easily create and manage local iPhone backups using iTunes or Finder, ensuring your data stays safe even without iCloud.

---

1. Why You Should Back Up Your iPhone to a Computer

Backing up to your computer has several advantages over iCloud:

• Unlimited storage (depends on your hard drive space).

• Faster backup speed, especially for large files.

• Offline access—no need for an internet connection.

• Extra privacy, since your backup stays local.

📌 According to Apple Support, iTunes and Finder backups include nearly all your data, such as app data, settings, messages, and photos.

---

2. How to Back Up Your iPhone on a Windows PC (Using iTunes)

Step 1: Install the latest version of iTunes from the Apple website.
Step 2: Connect your iPhone to the computer using a USB cable.
Step 3: Open iTunes and click the iPhone icon in the top-left corner.
Step 4: Under Backups, select “This Computer” and click “Back Up Now.”
Step 5: Wait for the process to complete, then verify under Preferences → Devices.

💡 Tip: You can enable “Encrypt local backup” to include passwords and health data.

---

3. How to Back Up Your iPhone on a Mac (Using Finder)

If you’re using macOS Catalina or later, you’ll back up your iPhone through Finder instead of iTunes.

Steps:

1. Connect your iPhone via cable.

2. Open Finder, then select your iPhone under Locations.

3. Under Backups, choose Back up all data on your iPhone to this Mac.

4. Click Back Up Now to start the process.

---

4. How to Restore from a Computer Backup

To restore your data:

1. Connect your iPhone to the same computer used for backup.

2. In iTunes or Finder, select Restore Backup.

3. Choose your latest backup file and click Restore.

👉 Related reading: Veeam File-Level Recovery – Open VM Backup Solution

---

5. Best Practices for iPhone Data Protection

• Back up at least once a month.

• Store backups on an external drive for extra protection.

• Use encryption for added security.

• Combine local and cloud backups for redundancy.

For advanced users, tools like iMazing or AnyTrans offer additional management features such as selective backups, app transfer, and device cloning.

---

Conclusion

Regularly backing up your iPhone to a computer is one of the simplest yet most powerful ways to protect your valuable data.

Whether you use iTunes on Windows or Finder on Mac, following these steps ensures your photos, messages, and settings are safe even if your phone is lost or damaged.

Start today—because your data is worth protecting.

 

Hidden Shortcuts in Veeam Backup & Replication (VBR) – Boost Efficiency Like a Pro

Introduction

Most administrators use Veeam Backup & Replication (VBR) every day—but few know the hidden shortcuts that can significantly speed up management tasks. These built-in tricks improve efficiency, simplify navigation, and make backup operations smoother.

In this article, we’ll reveal the hidden VBR shortcuts, console tricks, and best practices that can turn you into a Veeam power user.

Why Learn Veeam Shortcuts?

Veeam’s interface is designed for usability, but keyboard shortcuts and hidden console functions allow experienced users to work faster.

Benefits include:

• Save time on daily backup administration.

• Quickly access logs, job settings, and reports.

• Enhance accuracy by avoiding repetitive clicks.

📌 According to Veeam’s Knowledge Base, using built-in console shortcuts reduces operational workload by up to 30% in large environments.

[Ctrl] + Right Mouse Click

In many operations, you can use Ctrl + Right Mouse Click to bring up special menus. Generally, if you don't hold down the Ctrl key, you won't see these hidden menus when you right-click normally.

Performing a brand new job in the NAS backup

Normal NAS file backups in Veeam are forever-incremental backups. However, some users still need to perform a brand new full backup. Veeam also provides this function in NAS backups. Simply select the backup job you want to execute, hold down the Ctrl key, and then right-click. The full backup button will then appear.

After performing this full backup, a situation slightly different from a regular virtual machine full backup/synthetic full backup will occur: the previous backup data will be moved to Disk(Imported), and the new backup chain will replace the old one, becoming the new active NAS forever-incremental backup chain.

Oracle/SAP HANA Backup Job Force Delete

After configuring and running Oracle or SAP HANA backup jobs, VBR will display jobs of type Oracle Rman backup or SAP Backup. Right-clicking these jobs will show a Delete option, but this Delete option requires first deleting the RMAN or SAP HANA backup archives. If you don't want to delete the archives but only want to remove the backup job, you can use Ctrl+right-click to access the Force Delete option.

SOBR's Run tiering job now

I think many friends must be troubled by the rigid setting of uploading data to the cloud every 4 hours. Actually, there's a hidden right-click menu. Hold down Ctrl and right-click on the Scale-Out Backup Repository, and you'll discover this button to immediately run the Tiering job.

Directional Arrow Keys

In VBR's Jobs section, double-clicking each backup job allows you to view the latest execution details. However, if you want to look at older historical jobs, you might get lost in VBR's console. A slightly more complex method is to open the History panel and manually search for the desired date, or use keyword filters.

Actually, you don't need to open the History panel at all. VBR provides a way to view historical jobs directly from each job's details screen. Simply press the left and right arrow keys on the detailed task information interface to browse through past records. While not as flexible as selecting from the History panel, this method is excellent for quick troubleshooting.

Other Hidden Right-Click Menus

In some interfaces, there are hidden right-click menus that are not easy to discover but can be very useful. In most cases, these right-click operations are designed not to interfere with normal user actions, which is why they aren't easily noticeable.

Right-click in the SureBackup Statistics window

Double-click a SureBackup Job to open the Statistics window, where you can see the success or failure status of each VM from the last job execution. In addition to this static view, there is a hidden Start button. By selecting any VM in the Statistics window, you can not only view the execution details in the log below, but also right-click to Start this Datalab again.

This Start button is primarily used for troubleshooting when SureBackup fails. After clicking Start, the Session log will indicate that SureBackup has switched to Troubleshooting mode. In this mode, the SureBackup Job will not be terminated immediately upon success or failure—it will remain running until manually stopped. Please ensure that after troubleshooting or use, you press the Stop button to end it.

Backups stored in a backup repository containing a Capacity Tier

Typically, when you right-click on a backup in the Backups properties dialog, a regular backup repository will only have a "Copy Path" button. This is designed to allow us to quickly locate the corresponding .vbk or .vib file within the file system.

However, in some cases, if the Scale-Out Backup Repository (SOBR) includes a Capacity Tier and certain conditions are met, right-clicking on these backup files will bring up a new context menu.

This restarts the management console without rebooting the host.

👉 Related reading: Making VBR Login More Secure – Complete Guide

Conclusion

These hidden shortcuts in Veeam Backup & Replication may seem small, but together they deliver huge time savings for IT administrators.

By mastering VBR console shortcuts and PowerShell automation, you can work smarter, reduce errors, and maximize productivity in your backup environment.

Try integrating these techniques into your daily workflow—you’ll notice immediate performance improvements and smoother Veeam operations.