Modern ransomware operators target backups first

The ransomware business model depends on the victim having no clean recovery path. Early ransomware groups encrypted files and demanded payment. Defenders responded with better backups. Ransomware operators adapted: before deploying encryption, they now spend days or weeks inside the victim network identifying and destroying backup infrastructure. The dwell-time-before-encryption pattern — observed in the majority of significant enterprise ransomware incidents since 2020 — exists specifically to eliminate the recovery option.

A Malaysian manufacturing company that was hit by ransomware in 2023 discovered that all three of its backup servers had been encrypted simultaneously — days before the production encryption event. Its IT team had been monitoring successful backup jobs for months without ever verifying that those jobs produced recoverable data. The company paid the ransom, which is the intended outcome of this attack pattern.

Immutable backup changes the attacker economics. If the backup data cannot be deleted or encrypted regardless of what credential is compromised, the attacker loses the ability to remove the recovery option. Ransomware still causes damage — production downtime while systems are restored — but the alternative to paying (restore from clean backup) becomes credible. For organisations with effective immutable backup, the expected ransomware recovery cost drops by an order of magnitude compared to organisations without it. Pair this with Endpoint-as-a-Service for detection before encryption and see the full managed security leasing overview.

Frequently asked questions