IBM i & AIX Security
IBM i and AIX Security: What Actually Gets Attacked
The honest threat model for Power systems. Where the real exposure sits, what the documented incidents show, and the questions worth asking your provider.
Independent analysis, sourced to published advisories and trade reporting. No security product to sell you.
Are IBM i and AIX safe from ransomware?
Neither platform is usually where an attack starts, and neither is out of reach. Attackers get in through the Windows estate, stolen credentials, or an unpatched internet-facing service, then reach the Power system through what it shares with the rest of the network: IFS folders mapped as Windows drives, network services like DDM and NIM, and the backup infrastructure that protects it. The platform is not the weak point. What connects to it usually is.
The Threat Model
How attacks actually reach a Power system
In the documented cases, the Power box is rarely patient zero. It is what the attacker reaches on day three.
The Windows estate goes first
Phishing, a stolen VPN credential, or an unpatched public-facing application gets the attacker onto the network. IBM's 2026 X-Force index found vulnerability exploitation was the single leading cause of attacks at 40 percent of incidents, with a 44 percent rise in intrusions starting at a public-facing application.
The IFS looks like a Windows folder
The Integrated File System presented over IBM i NetServer appears to ransomware as an ordinary SMB share. If a mapped drive has write access, the encryption spreads there exactly as it would to any file server. The IBM i itself is never infected, but its files are.
Excess authority multiplies the damage
In one documented case a user with *ALLOBJ authority and a mapped drive opened a malicious attachment on a Friday afternoon. The malware had the whole weekend and reached roughly half a million files. Recovery took about a month.
Network services are genuinely exploitable
CVE-2023-30990 allowed unauthenticated remote CL command execution against the IBM i Distributed Data Management (DDM) server across releases 7.2 through 7.5. On AIX, CVE-2024-56346 scored a perfect 10.0 against the NIM master service. These are not theoretical.
The backup tier is a target, not a refuge
Modern ransomware crews locate and destroy backups before they encrypt anything. Finland's national cyber security centre reported Akira operators wiping both network attached storage and tape backup devices during a December 2023 attack wave.
Obscurity has stopped working
Silent Signal has published exploit development research for IBM i, and the platform's own security community now says the quiet part out loud. Assume an attacker who reaches your Power system knows what it is and how to talk to it.
Exposure by Layer
Where the risk actually sits
Treating the Power system as a single object hides the problem. The exposure is distributed across six layers, and they are not equally well defended in most environments.
| Option | What the exposure is | What reduces it |
|---|---|---|
| Windows and endpoint estate | The usual entry point. Phishing, stolen VPN credentials, and unpatched public-facing applications. | Multi-factor authentication everywhere, endpoint detection, and prompt patching of anything internet-facing. |
| IFS shares and NetServer | Read and write shares near root level, and mapped drives on user PCs, let Windows ransomware encrypt IFS files directly. | Audit every share, remove ones nobody remembers creating, and restrict write access to the narrowest path that works. |
| User profiles and authority | Profiles carrying *ALLOBJ authority that the job does not require turn a single infected PC into a full-system event. | Least privilege review, public *EXCLUDE on sensitive objects, and periodic authority reporting. |
| IBM i network services | DDM, ODBC, and database connections that bypass application-level security. CVE-2023-30990 allowed unauthenticated remote command execution. | Disable services you do not use, apply PTFs on a schedule, and put exit-point controls on the ones you keep. |
| AIX NIM and system services | CVE-2024-56346 (CVSS 10.0) and CVE-2024-56347 (9.6) allow remote command execution against NIM services on AIX 7.2 and 7.3. | Patch to current technology level, and keep NIM off any network segment it does not need to reach. |
| Backup software and devices | BRMS, Storage Protect, virtual tape libraries, and third-party backup servers have all carried high-severity flaws, and are actively hunted during attacks. | An immutable or genuinely offline copy, separate credentials for the backup tier, and a patch cadence that covers backup software too. |
Decision Aids
What to conclude from this
Best fit
The highest-value fixes are configuration, not products
Auditing IFS shares, reducing *ALLOBJ profiles, and getting one backup copy genuinely out of reach cost almost nothing and address the majority of documented cases. Do these before evaluating any security product.
Use caution
Backups on the same network are not backups
CloudNordic lost primary, replication, and secondary backup systems in one 2023 attack and could not recover most customer data. If stolen administrator credentials reach every copy, you have redundancy without recoverability.
Key decision
Hosting changes who is responsible, not whether it matters
Moving to a provider can improve patch cadence and backup isolation, or quietly make both worse. The difference is whether you asked the specific questions before signing, not whether the workload sits in a data center you own.
Documented Cases
What has actually happened
Victims almost never disclose which platform was breached, so named IBM i and AIX incidents are rare. These are the cases that have been documented publicly, with the platform detail intact.
$200,000 paid for IFS files
A company paid a $200,000 bitcoin ransom for the key to decrypt its Integrated File System files, in one of two IBM i cases documented by IT Jungle in 2017 and sourced to a HelpSystems security consultant.
One weekend, one month of recovery
A second 2017 case: a user with *ALLOBJ authority and a mapped IFS drive opened a malicious attachment on a Friday. Roughly 500,000 files were affected and 248,000 confirmed infected. TCP services went down, batch jobs halted, and recovery ran about a month. Clean pre-attack backups were what saved it.
Conti hit the Windows estate, missed the IBM i
A midsize US distributor was hit by Conti in May 2021. The Windows environment was encrypted twice in one week. The IBM i running its ERP was untouched despite sitting on the same network. The IT manager's read was that the attackers either did not see it or did not know what it was.
Tape kept a shop out of the ransom conversation
In that same 2021 case, the company had moved to LTO-7 tape during a Power9 upgrade weeks earlier. The manager's line was that there was no way the attackers could delete the backups, because that was not an ability within the software. Shipping resumed within days.
49 tapes quick-formatted in the library
Attackers reached a logistics company's tape library and quick-formatted 49 LTO-9 tapes holding Veeam backups, destroying the tape structures so the backup software could no longer read them. Ontrack recovered all 49 forensically, which is not a service you want to be depending on.
A hosting provider lost every copy at once
CloudNordic was attacked on 18 August 2023 while moving between data centres. Infected systems were cabled onto the internal network, handing attackers the admin systems and every backup tier. Primary, replication, and secondary backups were all encrypted. Most customers lost everything.
Published Vulnerabilities
Recent CVEs worth knowing about
A representative sample rather than a complete list, drawn from IBM security bulletins and vendor advisories. Confirm applicability against your own release and technology level with IBM before acting on anything here.
| Option | What it allows | Affected |
|---|---|---|
| CVE-2024-56346 (CVSS 10.0) | Remote arbitrary command execution against the AIX nimesis NIM master service. No privileges and no user interaction required. | AIX 7.2 and 7.3. |
| CVE-2024-56347 (CVSS 9.6) | Remote arbitrary command execution via weaknesses in the nimsh service SSL/TLS protection. | AIX 7.2 and 7.3. |
| CVE-2023-30990 | Unauthenticated remote CL command execution against the IBM i Distributed Data Management (DDM) server. Reported by Silent Signal. | IBM i 7.2, 7.3, 7.4, and 7.5. |
| CVE-2025-33108 (CVSS 8.5) | Privilege escalation through an unqualified library call made by a Backup, Recovery and Media Services (BRMS) program, allowing attacker code to run with elevated privilege. | IBM i 7.4 and 7.5. |
| CVE-2026-7870 (CVSS 8.8) | Privilege escalation on IBM i via an unqualified library call, letting user-controlled code run with administrator privilege. Same bug class as the BRMS flaw above. | IBM i. Confirm affected releases in the IBM bulletin. |
| CVE-2025-3319 (CVSS 8.1) | Authorization bypass against the IBM Storage Protect Server built-in admin account using a custom client. No workaround published. | Storage Protect Server 8.1.0 through 8.1.26. Fixed in 8.1.27. |
| TS7700 virtual tape library | The TS7700 inherits the AIX NIM command execution flaws above because it runs AIX NIM. IBM's stated mitigation is restricting network access, which reduces but does not eliminate the risk. | IBM Virtualization Engine TS7700. |
| CVE-2024-40711 (CVSS 9.8) | Unauthenticated remote code execution in Veeam Backup & Replication. Added to the CISA Known Exploited Vulnerabilities catalog and used to deploy Akira and Fog ransomware. | Veeam Backup & Replication before 12.2. |
| CVE-2026-14512 and CVE-2026-14446 (CVSS 9.8) | Pre-authentication unsafe deserialization and privilege escalation in IBM WebSphere Application Server, the standard Java stack on both AIX and IBM i. Disclosed 28 July 2026. | IBM WebSphere Application Server. Confirm affected versions in the IBM bulletin. |
Practical Sequence
A hardening order that matches where the risk is
Ordered by return on effort rather than by what a product vendor would sell you first.
- 1
Inventory every IFS share and mapped drive
Find shares nobody remembers creating, especially any with write access at or near root. This is the single most common path in documented IBM i encryption cases.
- 2
Reduce *ALLOBJ and review public authority
List the profiles carrying *ALLOBJ authority and justify each one. Set sensitive objects to public *EXCLUDE. Excess authority is what turns one infected PC into a full-system incident.
- 3
Get one backup copy genuinely out of reach
Immutable, air gapped, or offline. The test is simple: if an attacker holds your domain and backup administrator credentials, can they still destroy this copy? If yes, it does not count.
- 4
Patch the platform and the backup tier on a schedule
PTFs for IBM i, technology levels for AIX, and updates for BRMS, Storage Protect, virtual tape libraries, and any third-party backup software. The backup tier is regularly the least-patched system in the room.
- 5
Close or control the network services you do not need
Disable unused services, restrict NIM to the segments that require it, and apply exit-point controls to ODBC, FTP, and DDM traffic that bypasses application-level security.
- 6
Pull IBM i and AIX into the same monitoring as everything else
These systems commonly sit outside the SIEM, which means an intrusion there is invisible to the team watching every other platform. Feed the audit journal and AIX logs into the same place.
- 7
Test a restore, do not assume one
Restore to a clean environment and time it. A recovery objective nobody has rehearsed is an estimate, and ransomware is not the moment to discover the tape structures are unreadable.
Provider Due Diligence
Six questions to ask a Power hosting or cloud provider
Where the workload lives matters less than the answers to these. Ask them before signing, and get the answers in the contract rather than in a sales call.
Is there an immutable or offline backup copy?
Not replicated. Not a second copy on the same storage platform. A copy that cannot be deleted or encrypted by someone holding administrator credentials.
Who holds the restore keys?
If the provider's own administrators can destroy every copy of your data, their credential hygiene is now your risk. Ask how that access is separated and monitored.
What is the patch SLA, including backup software?
Ask specifically about the backup tier. Storage Protect, BRMS, and virtual tape libraries have all carried high-severity flaws, and they are often the last thing patched.
Is multi-factor authentication enforced on the management plane?
Several documented ransomware intrusions began at a VPN or management portal without MFA. This is a yes or no question and the answer should be yes.
What is the tested recovery time, and when was it last tested?
A published RTO is a marketing number until someone has rehearsed it against your workload. Ask for the date of the last test and what it measured.
How is your environment separated from other tenants?
CloudNordic's customers were hit because infected systems reached the internal network during a data centre move. Ask what stops one tenant's incident from becoming yours.
Compare providers →Frequently asked questions about IBM i and AIX security
Can an AS/400 or IBM i system get ransomware?
Yes, though usually not the way people expect. Ransomware rarely runs on IBM i itself. It runs on a Windows machine that has a mapped drive to a share in the Integrated File System (IFS), and it encrypts those files over standard SMB just as it would any other network folder. Documented cases include one company that paid a $200,000 bitcoin ransom to recover IFS files, and another that spent roughly a month recovering after a single infected PC reached the IFS over a weekend.
Is IBM i secure by default?
IBM i has strong native security controls, but secure by default is not the same as secure as configured. The recurring problems found in real environments are user profiles with *ALLOBJ authority that do not need it, IFS shares with read and write access at or near root level, and network services left enabled and unpatched. The platform gives you the controls. Whether they are switched on is an environment-by-environment question.
Does security through obscurity still protect IBM i and AIX?
Less every year. Silent Signal has published working exploit development research for IBM i, and IBM i security practitioners now argue the opposite case publicly. In a March 2026 IT Jungle interview, Carol Woodbury of Kisco said security through obscurity was never something you wanted to bank on, and Kisco owner Justin Loeber added that AI has completely destroyed whatever protection security through obscurity offered.
Are AIX systems targeted directly?
AIX is not a mass-market ransomware target, but its network services carry serious, publicly documented flaws. In 2025 IBM patched CVE-2024-56346, a CVSS 10.0 remote command execution flaw in the AIX nimesis Network Installation Manager (NIM) master service, alongside CVE-2024-56347 at 9.6 in the nimsh service. Both affect AIX 7.2 and 7.3 and require no privileges to exploit over the network.
Why does the backup system matter so much in a ransomware attack?
Because attackers go after it first. Finland's national cyber security centre reported that Akira operators deleted backup data on network attached storage and tape backup devices in a wave of December 2023 attacks. Veeam's 2025 research found 89 percent of organisations reported attackers targeting their backups, while only 32 percent used immutable repositories. A backup that the attacker can reach with stolen administrator credentials is not a recovery plan.
Does moving IBM i or AIX to a hosted or cloud provider make it safer?
It changes who is responsible, which is not automatically the same as safer. A provider with a real patch cadence, multi-factor authentication on the management plane, and an immutable or genuinely offline backup copy improves your position. A provider that keeps your backups on the same network as production does not. The Danish hosting provider CloudNordic lost its primary, replication, and secondary backup systems to a single 2023 attack and could not recover most customer data. Ask the specific questions rather than assuming.
What single change reduces IBM i ransomware exposure the most?
Removing broad read and write IFS shares, and reducing the number of user profiles carrying *ALLOBJ authority. Nearly every documented IBM i encryption case traces back to a Windows endpoint with a mapped drive and more authority than the job required.
Sources
- IBM Security Bulletin: AIX is vulnerable to arbitrary command execution (CVE-2024-56346, CVE-2024-56347)
- IBM Security Bulletin: IBM Storage Protect Server authorization bypass (CVE-2025-3319)
- IBM Security Bulletin: TS7700 tampering and elevation of privilege due to the use of AIX NIM
- Silent Signal: critical IBM i DDM vulnerability, CVE-2023-30990
- Silent Signal techblog: exploit development for IBM i
- IT Jungle: Assessing the ransomware threat on IBM i (2017)
- IT Jungle: One IBM i shop's close call with ransomware (2021)
- IT Jungle: BRMS isn't the only backup product with a security problem (2025)
- IT Jungle: What is threatening IBM i security now (2026)
- BleepingComputer: Finland warns of Akira ransomware wiping NAS and tape backup devices
- CISA: #StopRansomware Akira advisory (AA24-109A)
- Ontrack case study: tape recovery after a ransomware attack on a logistics company
- SecurityWeek: hosting provider CloudNordic loses all customer data in ransomware attack
- Microsoft Threat Intelligence: Storm-0501's evolving techniques lead to cloud-based ransomware
- IBM 2026 X-Force Threat Intelligence Index
- Veeam ransomware trends research on backup targeting and immutability
Find Out Where Your Power Environment Is Exposed
An independent read on your IFS shares, authority model, backup isolation, and provider terms, without a security product attached to the answer.