Ransomware has a new target. Is your backup ready?
Ransomware groups increasingly target backup infrastructure to eliminate recovery options and force ransom payments.
Ransomware operators are evolving tactics to destroy backup systems before encrypting primary data, eliminating victim recovery options and increasing pressure to pay. Notable cases include ALPHV/BlackCat targeting Change Healthcare (resulting in $22M ransom and $1.6B total recovery costs), BlackMatter destroying backups at agricultural cooperatives, and Gunra ransomware targeting both primary and disaster recovery sites. Organizations must isolate backups, limit administrative access, and ensure no single compromised credential can reach all recovery copies.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaseya?
Get an email when a new story names Kaseya, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonModern ransomware operators have shifted tactics to actively identify and destroy backup systems before encrypting primary data, eliminating the victim's most critical lifeline. The ALPHV/BlackCat attack on Change Healthcare demonstrated the devastating financial scale of this approach — $22M in ransom and $1.6B in total recovery costs — while groups like BlackMatter and Gunra have replicated this strategy against agricultural and disaster recovery infrastructure. The core failure is that backup systems were reachable from the same compromised credentials or network segments as production systems, meaning a single breach could cascade to eliminate all recovery options. This matters because without resilient, isolated backups, organizations face a binary choice: pay the ransom or suffer catastrophic data loss. Treating backups as an afterthought rather than a security-critical asset is no longer acceptable.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ALPHV/BlackCat
- malware — BlackMatter
- malware — Gunra