Backups are ransomware targets
Modern ransomware crews look for the backups first, because destroying them is what makes payment necessary.
They are frequently reachable from the environment with credentials that exist in it, which makes them easier to delete than the data is to encrypt. Isolation and immutability are not backup best practice any more; they are the difference between having backups and appearing to.
More on Ransomware and malware
- Ransomware is often the last stage, not the firstThe bang is the end of the fuse
- Lateral movement turns one foothold into manyAlong the loft, house to house
- Command and control gives malware an operatorSomebody is still holding the controller
- Persistence is about surviving changeStill there after the tide
- Living off the land reduces new-tool visibilityThey use your tools, not theirs
- Ransomware recovery is an identity problem tooThe data is the easy half