Ransomware has a new target. Is your backup ready?

Ransomware threat actors have shifted focus to attacking backup infrastructure directly, aiming to wipe recovery points before encrypting production data. Notable groups like ALPHV/BlackCat, BlackMatter, and Gunra have demonstrated tactics including exploiting weak remote access, using compromised admin credentials to locate and delete backups across networks and disaster recovery sites. These attacks exploit common weaknesses such as shared network access and credentials between production and backup environments, unpatched backup software, and insufficient monitoring of backup infrastructure. Effective defense requires immutable storage, network and credential isolation, multi-factor authentication, prompt patching of backup software, and regular testing of backup restores.

The destruction of backups removes the victim's ability to recover data without paying ransom, significantly increasing financial and operational impact. For example, UnitedHealth's incident involving ALPHV/BlackCat resulted in a $22 million ransom payment and $1.6 billion in recovery costs. Backup destruction raises the stakes of ransomware attacks by eliminating fallback options, leading to longer downtime, higher ransom demands, and increased risk to brand reputation.

Organizations should implement immutable backup storage that cannot be altered or deleted even by administrators, enforce strict network and credential isolation between production and backup environments, and apply multi-factor authentication and role-based access controls for backup infrastructure. Backup software must be patched with the same urgency as production systems. Regular testing of backup restores, including attack scenario simulations, is essential to verify recovery capability. These measures collectively reduce the risk that attackers can reach and destroy backups. No official patch or fix applies as this is a threat actor tactic rather than a software vulnerability.