Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed
Written by AI from the linked story. Not reviewed by an editor. How this works
Modern ransomware operators have shifted tactics to actively identify and destroy backup systems before encrypting primary data, eliminating the victim's most critical lifeline. The ALPHV/BlackCat attack on Change Healthcare demonstrated the devastating financial scale of this approach — $22M in ransom and $1.6B in total recovery costs — while groups like BlackMatter and Gunra have replicated this strategy against agricultural and disaster recovery infrastructure. The core failure is that backup systems were reachable from the same compromised credentials or network segments as production systems, meaning a single breach could cascade to eliminate all recovery options. This matters because without resilient, isolated backups, organizations face a binary choice: pay the ransom or suffer catastrophic data loss. Treating backups as an afterthought rather than a security-critical asset is no longer acceptable.
Tactical Insight
Immediate actions
- Implement the 3-2-1-1 backup rule: three copies, two media types, one offsite, and one air-gapped or immutable copy that ransomware cannot reach.
- Audit and revoke any administrative credentials that have simultaneous access to both production systems and backup infrastructure.
- Enable immutability (WORM — Write Once Read Many) on all backup storage targets to prevent ransomware from deleting or overwriting backup data.
Long-term improvements
- Isolate backup and disaster recovery systems on separate network segments with strict firewall rules that block inbound connections from production environments.
- Establish a dedicated, non-privileged backup service account with least-privilege access and enforce MFA for any human access to backup management consoles.
- Regularly test full restoration procedures — including disaster recovery site failover — so recovery time is measured and validated before a crisis occurs.
Detection measures
- Configure alerting on backup job failures, unexpected deletion events, or changes to backup schedules, treating these as high-priority security incidents.
- Monitor for unusual volume shadow copy (VSS) deletion commands (e.g., `vssadmin delete shadows`) as an early ransomware pre-encryption indicator.
- Implement behavioral analytics to flag any account accessing both production and backup systems within an anomalous time window.