[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLgE1w1DKjrM3N4ZzOYu4rX2iD9tK-AN19D0XYsAIU0A":3},{"article":4,"iocs":45,"watch_terms":53,"solutions":54,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"e1b7a096-b5da-4862-a176-646a56aaff09","Ransomware has a new target. Is your backup ready?","ransomware-has-a-new-target-is-your-backup-ready-69f65e","Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. [...]","Ransomware operators are evolving tactics to destroy backup systems before encrypting primary data, eliminating victim recovery options and increasing pressure to pay. Notable cases include ALPHV\u002FBlackCat targeting Change Healthcare (resulting in $22M ransom and $1.6B total recovery costs), BlackMatter destroying backups at agricultural cooperatives, and Gunra ransomware targeting both primary and disaster recovery sites. Organizations must isolate backups, limit administrative access, and ensure no single compromised credential can reach all recovery copies.","Ransomware groups increasingly target backup infrastructure to eliminate recovery options and force ransom payments.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fransomware-has-a-new-target-is-your-backup-ready\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F30\u002Fsecure-backup-vault.jpg","2026-10-07T14:01:11+00:00","2026-10-07T16:00:06.430343+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"ALPHV\u002FBlackCat","threat_actor",{"name":21,"type":19},"BlackMatter",{"name":23,"type":19},"Gunra",{"name":25,"type":26},"Kaseya","vendor",{"name":28,"type":26},"IBM","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":29,"icon":31,"name":32,"slug":33},null,"Ransomware","ransomware",[35,40],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,49,51],{"type":47,"value":18,"context":48},"malware","Ransomware group that encrypted Change Healthcare systems in February 2024 after exploiting unprotected remote access portal",{"type":47,"value":21,"context":50},"Ransomware group that made backup destruction standard procedure, targeted NEW Cooperative and Crystal Valley in 2021",{"type":47,"value":23,"context":52},"Ransomware documented in CISA\u002FFBI advisory August 2026, deleted backups at primary data center and disaster recovery site",[25,28],{"controls":55,"vendors":139},[56,84,110],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,68,76],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":57,"product_name":65,"url":66,"description":67},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":85,"name":86,"problem":87,"products":88},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":106,"product_name":107,"url":108,"description":109},"zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":111,"name":112,"problem":113,"products":114},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"ransomware-groups-now-target-backups-first-recovery-is-no-longer-guaranteed","Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed","Modern ransomware operators have shifted tactics to actively identify and destroy backup systems before encrypting primary data, eliminating the victim's most critical lifeline. The ALPHV\u002FBlackCat attack on Change Healthcare demonstrated the devastating financial scale of this approach — $22M in ransom and $1.6B in total recovery costs — while groups like BlackMatter and Gunra have replicated this strategy against agricultural and disaster recovery infrastructure. The core failure is that backup systems were reachable from the same compromised credentials or network segments as production systems, meaning a single breach could cascade to eliminate all recovery options. This matters because without resilient, isolated backups, organizations face a binary choice: pay the ransom or suffer catastrophic data loss. Treating backups as an afterthought rather than a security-critical asset is no longer acceptable.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 11 – Data Recovery","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-34 – Contingency Planning Guide","NIST CP-9 – Information System Backup","NIST CP-10 – Information System Recovery and Reconstitution","NIST AC-6 – Least Privilege","NIST SI-3 – Malicious Code Protection","ITIL – Availability Management \u002F IT Service Continuity Management","GDPR Article 32 – Security of Processing (resilience and recovery obligations)","HIPAA § 164.308(a)(7) – Contingency Plan (applicable given Change Healthcare breach)",{}]