# Backup in Ransomware Attacks: How Do Attackers Target Backups?

**URL:** https://securesys.com.tr/en/learning/backup-and-business-continuity/how-ransomware-targets-backups

![Backup in Ransomware Attacks: How Do Attackers Target Backups?](/images/bilgi-merkezi/covers/cover-backup-06.webp)

For a long time, ransomware attacks were assessed solely through the encryption of files.

A user's computer gets infected.

The files are encrypted.

A ransom note appears on the screen.

If there is a backup, you come back from it.

This classic scenario is still possible today, but advanced ransomware operations now work in a far different way.

The modern attacker's goal is not merely to encrypt the data.

**The real aim is to destroy the organization's recovery capacity.**

Because if the organization has an intact, clean and secure backup, the attacker's bargaining power declines.

If the organization can bring its systems back within a few hours or a few days, the likelihood of paying the ransom may drop as well.

For this reason, in advanced ransomware operations, attackers now target these systems in particular:

- backup servers,
- backup administrator accounts,
- storage systems,
- hypervisor infrastructure,
- snapshots,
- backup repositories,
- cloud backup accounts,
- Active Directory,
- credential vaults,
- DR infrastructure.

**This shift has taken backup security out of the classic data protection approach and made it directly a part of cyber security.**

Today the success of a backup solution must not be measured only by this question:

**“Are we taking backups?”**

The real question is this:

**“When the attacker gets inside, can they delete these backups?”**

### How Does a Ransomware Attack Actually Progress?

Many organizations think of a ransomware attack as a single stage.

In reality the attack can take weeks.

After getting inside, the attacker may not encrypt immediately.

A sample attack process may progress as follows:

#### \1. Initial Access

The attacker obtains initial access into the organization.

This access;

phishing,

a weak password,

a compromised VPN account,

a vulnerability in an internet-facing system,

credential stuffing,

RDP,

supply chain

can occur through methods such as these.

At this stage the attacker usually holds low privileges.

They may not yet have access to the backup system.

### \2. Establishing Persistence

To avoid losing the initial access, the attacker may try to establish persistence mechanisms.

For example;

a new user account,

a scheduled task,

a service,

a registry change,

a web shell,

a remote management tool

can be used.

The purpose is to remain inside even if the organization closes the attacker's initial entry point.

### \3. Credential Discovery

One of the most critical stages of ransomware attacks is credential access.

The attacker;

user passwords,

administrator credentials,

service accounts,

stored passwords,

browser credentials,

cached credentials

may try to gather information such as this.

Because reaching the backup infrastructure most often requires a highly privileged account.

### What Is Credential Dumping?

Credential Dumping is the method of extracting passwords, hashes or authentication material from the operating system or applications.

In Windows environments attackers can target processes such as LSASS.

They may also;

SAM,

NTDS.dit,

the browser password store,

the registry,

memory

try to gather credentials from sources such as these.

The attacker's target is most often not the password itself.

An NTLM hash or a session token may also be enough to continue the attack.

For this reason the credential security of the backup administrator account is extremely critical.

### \4. Privilege Escalation

From a low-privileged user, the attacker tries to reach:

Local Administrator

and then:

Domain Administrator

level in turn.

This stage is critical particularly from a backup security perspective.

Because in many organizations the backup infrastructure is directly integrated with Active Directory.

If a Domain Admin can also manage the backup system, the attacker can reach the entire recovery infrastructure with a single account.

### \5. Active Directory Discovery

The attacker can analyse the Active Directory structure.

For example;

domain controllers,

administrator groups,

service accounts,

backup operator groups,

GPOs,

server names,

network shares

can be identified.

This reconnaissance helps the attacker understand which accounts hold privileges on the backup infrastructure.

### Why Is the Backup Operators Group Critical?

In Windows environments there can be special privileges for backup operations.

By examining these groups, the attacker can learn which accounts are used on backup systems.

In some organizations, granting more privileges than necessary to backup service accounts can increase the attack surface.

For this reason, on service accounts the:

#### Least Privilege

approach must be applied.

### \6. Network Discovery

The attacker can scan the corporate network.

The purpose is;

servers,

storage systems,

backup appliances,

NAS,

hypervisors,

management interfaces

to identify these.

Backup systems can most often be recognized even from their names.

For example:

backup01

veeam01

repository01

nas-backup

dr-backup

names such as these can give the attacker a direct clue.

For this reason merely hiding the name is not a solution.

The real solution is to restrict access.

### \7. Backup Discovery

This stage carries critical importance in modern ransomware operations.

The attacker tries to determine which backup technology is used inside the system.

For example;

running services,

installed software,

Windows services,

the process list,

network connections,

DNS records,

the registry,

the file system

can be examined.

The purpose is to identify the backup product and the management server.

### Why Is Knowing the Backup Product Dangerous?

Once an attacker learns which backup software is in use, they can research that product's architecture.

The backup;

which ports does it use,

with which service accounts does it run,

where is the repository,

where are the config files,

how are the credentials kept

they can analyse information such as this.

For this reason backup servers must be treated as critical security systems.

### \8. Targeting the Backup Administrator Account

One of the attacker's most valuable targets is the backup administrator account.

Because this account usually;

can create backup jobs,

can delete repositories,

can change retention,

can delete restore points,

can change backup policies.

If this account is the same as the daily user account, the risk grows further.

For this reason backup admin accounts absolutely must be separated.

### Why Is Managing E-Mail and Backup with the Same Account Dangerous?

For example, suppose an IT manager, with the:

admin@company.com

account, both uses Outlook and logs into the backup console.

If a phishing attack compromises this account, the attacker can reach the backup system directly.

For this reason:

the normal user account,

the server admin account,

the backup admin account

must be separate.

### \9. Targeting the Hypervisor

Many organizations use virtual infrastructure.

Consequently the attacker can target not only the backup system but hypervisor management as well.

For example;

VMware,

Hyper-V,

KVM

if the management layer of environments such as these is seized, the attacker can affect a large number of virtual machines at once.

Hypervisor privileges can also provide access to snapshots.

For this reason backup and virtualization management must be kept in different security layers.

### Why Is Snapshot Deletion Common?

Snapshots are very valuable for fast restore.

However, if the attacker obtains storage or hypervisor administrator privileges, they can delete the snapshots.

For this reason one of the targets frequently encountered in ransomware attacks is:

**eliminating the restore points.**

Snapshots provide fast recovery but do not on their own provide ransomware resilience.

### \10. Deleting Shadow Copies

On Windows systems, shadow copies created through the Volume Shadow Copy Service can be used for fast restore.

However, attackers can delete them.

The purpose is to prevent the user or the administrator from coming back quickly from previous copies on the system.

For this reason relying solely on local shadow copies is not correct.

### \11. Stopping Backup Jobs

The attacker can stop backup jobs before encryption.

For example;

the backup service is stopped,

the scheduler is turned off,

the job is disabled.

This action may go unnoticed for days before the attack.

For this reason backup job failures must be monitored by SIEM or a monitoring system.

### Why Can a Backup Job Failure Be a Security Event?

A backup job failure is not always an attack.

A disk can fill up.

The network can drop.

A credential can expire.

However, a critical backup job stopping unexpectedly must also be assessed from a security perspective.

Especially if at the same time;

an administrator login,

a retention change,

a backup service stop

events such as these occur, an alarm must be generated.

### \12. Changing Retention Policies

Instead of deleting the backup, the attacker can change the retention period.

For example:

30 days → 1 day

a change such as this can be made.

The backup system may then automatically delete the old restore points.

For this reason a retention change is a critical security event.

### Should a Retention Change Generate an Alarm?

Yes.

In a critical backup environment:

reducing retention,

changing the immutable period,

deleting a repository,

deleting a backup job

changes such as these must generate an alarm immediately.

### \13. Deleting the Backup Repository

The backup repository is one of the most valuable targets from the attacker's perspective.

If the repository is exposed as an ordinary SMB share or network storage, ransomware can encrypt the backup files directly.

For this reason the repository;

must not be reachable from the normal user network.

### Why Is an SMB Backup Repository Risky?

If the backup repository is:

\\backup\repository

a network share everyone can reach in this form, the attacker can get to that area after lateral movement.

For this reason using;

minimum access,

firewall segmentation,

separate credentials,

a hardened repository

is important.

### \14. Encrypting the Backup Files

The attacker can encrypt the backup files directly.

For example, if the backup repository resides on a Windows server and ransomware can be executed on that server, the backup files can be encrypted too.

For this reason it is important that backup files do not reside inside the same trust zone as the production environment.

### \15. Deleting Backup Catalogs

In backup systems, not only the backup files but also metadata and catalog information matter.

The backup catalog shows which restore point is where.

If the attacker deletes the catalog database, the restore process can become seriously difficult even though the backup files physically remain.

For this reason backup config and catalog backups must also be protected separately.

### \16. Targeting Encryption Keys

If the backup files are encrypted, the encryption keys carry critical importance.

If the attacker obtains the keys, they can read the data inside the backup.

If they delete the keys, the organization may be unable to restore its own backup.

For this reason encryption key management must be designed as a separate security layer.

### \17. Compromising Cloud Backup Accounts

Using cloud backup does not automatically eliminate the attacker risk.

If the attacker;

a cloud administrator,

an access key,

an API token,

a service principal

compromises one of these, they can reach the backup objects.

The risk can increase particularly if production and backup reside inside the same cloud account.

### What Is the Most Critical Mistake in Cloud Backup?

One of the most critical mistakes is managing production and backup environments with the same IAM privileges.

For example, if a single Global Administrator holds full privileges over both the production workload and the backup storage, the attacker's job becomes easier.

Using separate:

accounts,

subscriptions,

credentials,

MFA

can reduce the blast radius.

### \18. Deleting Object Storage

If the cloud backup is held on object storage, the attacker can delete the objects.

Against this risk;

Object Lock,

WORM,

retention lock,

immutable storage

can be used.

For this reason, in cloud backup design, using storage alone is not sufficient.

### \19. Targeting the DR Environment

Disaster Recovery environments can also be targets in ransomware attacks.

Especially in a DR environment continuously replicated with production, the encrypted data can be replicated as well.

For this reason DR alone is not a backup.

### Why Is DR Replication Not Sufficient Against Ransomware?

If a file is encrypted on the production system, replication can carry that to the DR system too.

In that case both environments can be affected at the same time.

For this reason, for ransomware resilience:

**Point-in-Time Backup + Immutable Copy + Air-Gap**

additional layers such as these are needed.

### \20. Deleting the Logs

The attacker may try to delete not only the backup system but the logs as well.

The purpose is to make it harder for the incident response team to understand what happened.

Backup administrator login logs,

repository access,

policy changes

must be sent to a central SIEM system.

### Why Must Backup Logs Be Kept in a Central System?

If the logs are kept only on the backup server, the attacker can delete them once they seize the server.

Central logs sent to SIEM form a separate security layer.

### IOCs That May Be Seen in the Backup Environment Before Ransomware

Before the attack begins, certain behaviours can serve as early warnings.

For example:

- an unexpected backup admin login,
- management access during night hours,
- creation of a new administrator,
- repository deletion attempts,
- a backup service stop,
- a retention policy change,
- an immutable setting change,
- MFA being turned off,
- a large number of failed logins,
- creation of a new API key,
- snapshot deletion,
- a backup job being disabled.

These behaviours must be monitored by the security teams.

### Should SIEM Use Cases Be Created for Backup Systems?

Yes.

Backup systems must have dedicated use cases for SIEM.

For example:

#### Use Case 1: Backup Administrator Login Outside Business Hours

A backup management login outside normal working hours can generate an alarm.

#### Use Case 2: Backup Retention Reduced

If the retention period is lowered, an alarm is created.

#### Use Case 3: Multiple Restore Points Deleted

If a large number of restore points are deleted in a short time, a critical alarm is created.

#### Use Case 4: Backup Service Stopped

If the backup service stops unexpectedly, an alarm is generated.

### What Should EDR Monitor on Backup Servers?

An EDR/XDR solution on the backup server can monitor;

PowerShell,

credential dumping,

suspicious processes,

remote execution,

lateral movement,

malware execution,

ransomware behaviour

behaviours such as these.

However, performance and product compatibility must be taken into account.

### Why Does Ransomware Stay Quiet Before Encryption?

The longer the attacker remains hidden, the more systems they can discover.

During this period they;

the backup system,

the DR environment,

administrator accounts,

critical data

identify these.

Encryption is usually the most visible stage of the attack.

But the incident began much earlier.

### What Is Dwell Time?

Dwell Time expresses the period the attacker remains undetected inside the system.

This period is very important from a ransomware recovery perspective.

Because if the attacker stayed in the system for weeks, all the newest backups may be compromised.

For this reason the attacker's initial access date matters for determining a clean restore point.

### The Newest Backup Is Not Always the Best Backup

For example, the attacker:

entered the system on 1 June.

Established persistence on 15 June.

Executed the ransomware on 25 June.

The 24 June backup may be technically intact.

But the attacker's malware may be present inside the backup.

For this reason the restore point must be selected according to the incident timeline.

### The First Thing Not to Do After Ransomware: a Hasty Restore

The desire to bring systems back up quickly after the attack is natural.

However, restoring directly into a compromised environment can cause reinfection.

The root cause of the attack must be understood first.

### The Recovery Process After Ransomware

A safe recovery process can generally include these stages:

#### \1. Isolation

Compromised systems are separated from the network.

#### \2. Incident Investigation

The initial access and the attack timeline are determined.

#### \3. Credential Reset

Critical accounts are changed.

#### \4. Selecting a Clean Restore Point

The trusted backup from before the attack is determined.

#### \5. Clean Room Recovery

The system is restored in an isolated environment.

#### \6. Malware and IOC Checks

The backup is scanned.

#### \7. Transition to Production

The system is brought back into service in a controlled manner.

### Should Active Directory Be Restored First?

In many environments Active Directory is one of the most critical recovery components.

Because other systems;

authentication,

DNS,

service accounts,

Group Policy

may depend on AD for these.

For this reason an AD forest recovery plan must be prepared in advance.

### Should All Passwords Be Changed After Ransomware?

Depending on the scope of the incident, critical credentials may need to be reset.

Especially;

Domain Admin,

backup admin,

cloud admin,

service account,

VPN account,

API key,

secret

credentials such as these must be assessed.

Because even if the backup is clean, the attacker may hold the credentials.

### Should Backup Administrator Credentials Be Among the First Accounts Changed?

In most scenarios, yes.

Making access to the backup environment secure is one of the fundamental stages of recovery.

Otherwise the attacker can reach the backup environment again during the restore process.

### What Should the Clean Room Network Look Like?

The Clean Room must be as isolated as possible from the production environment.

For example:

a separate VLAN,

a separate firewall zone,

separate DNS,

a separate admin account

can be used.

Internet access for the restored systems can be restricted in the first stage.

### Should the Backup Go Through a Malware Scan First?

Yes, it is useful particularly in ransomware incidents.

Backup files;

EDR,

antivirus,

YARA,

IOC scan

can be analysed with methods such as these.

The purpose is to prevent compromised files from being carried back into production.

### How Is Persistence Inside the Backup Detected?

On the restored system;

scheduled tasks,

services,

registry startup entries,

user accounts,

web shells,

remote management tools

persistence mechanisms such as these must be checked.

This work can be carried out together with the incident response team.

### How Does RPO Change in Ransomware Recovery?

During normal operation the RPO may be 15 minutes.

But if the attack has been in the system for 10 days, the last clean backup may be 11 days old.

In that case the theoretical RPO and the real cyber recovery RPO diverge.

This is an important difference.

### What Is Cyber Recovery RPO?

Cyber Recovery RPO expresses the clean and trusted data point that can be returned to after a cyber attack.

While the classic RPO takes only backup frequency into account, cyber recovery:

**cleanliness and trustworthiness**

also takes this factor into account.

### Why Can RTO Lengthen in Ransomware Recovery?

In a normal server failure the restore may take a few hours.

But in a ransomware incident, first;

forensic analysis,

credential reset,

network cleanup,

clean room,

malware scanning

may need to be performed.

For this reason the cyber incident RTO can be longer than the normal DR RTO.

### Should a Ransomware Scenario Be Included in Backup Restore Testing?

Absolutely.

Only the:

“The server was deleted, we restored it from backup.”

test is not sufficient.

This scenario must be tested as well:

**“Domain Admin is in the attacker's hands, production is completely compromised, and there is an attempt to attack the backup system.”**

This is a more realistic cyber recovery exercise.

### What Is a Tabletop Exercise?

A Tabletop Exercise is teams working through a crisis scenario at the table without shutting down real systems.

For example:

Ransomware was detected at 09:00.

The backup system is unreachable.

The Domain Admin account has been compromised.

The CEO wants a statement for customers.

In this situation, which team will do what?

Exercises of this kind increase Business Continuity and Incident Response maturity.

### Should a Technical Exercise Be Run Too?

Yes.

A tabletop alone is not sufficient.

In a real technical recovery exercise;

the backup is located,

it is restored,

DNS is started,

the database is opened,

the application is tested,

the RTO is measured.

This way it becomes visible whether the plan genuinely works.

### Backup Security Checklist Against Ransomware

In a critical backup environment these controls must be assessed:

- immutable backup,
- air gap,
- offsite backup,
- MFA,
- separate backup administrator accounts,
- isolation from the production domain,
- network segmentation,
- hardened repository,
- encryption,
- SIEM monitoring,
- EDR/XDR,
- retention lock,
- Object Lock,
- secure credential management,
- regular restore tests,
- clean room recovery,
- cyber recovery exercises.

### The Backup Itself Must Be Classified as a Critical Asset

Many organizations treat backup systems as ordinary infrastructure inside the CMDB or asset inventory.

Yet the backup system is one of the organization's most critical assets.

Because after an attack the entire organization's capacity to come back may depend on this system.

For this reason backup servers must be classified as;

Critical Asset

in the inventory.

### Should Vulnerability Management Be Applied to Backup Systems?

Yes.

Backup servers must also be included regularly in;

vulnerability scanning,

patch management,

hardening,

configuration review

these processes.

The “let's not touch it because it is the backup system” approach can create a security gap.

### Why Is Patch Management Sensitive?

Because the backup system is critical, patching must be done carefully.

However, unpatched backup software can also be a target for the attacker.

For this reason;

testing,

change management,

a backup of the backup config,

a rollback plan

patching must be done in a controlled way with these.

### Should Default Credentials Be Checked?

Absolutely.

Default accounts on backup appliances or storage devices must be disabled or made secure.

A default credential can be an easy entry point for the attacker.

### Backup API Security

Modern backup products can offer a REST API.

These APIs are valuable for automation.

However, if the API token is compromised, the attacker can perform critical operations.

For this reason;

API authentication,

token expiration,

IP restriction,

least privilege,

audit logging

must be applied.

### What Is a Break Glass Account in a Backup System?

A Break Glass Account is a special account used for emergency access when the normal identity infrastructure cannot be used.

For example, when the production AD is lost entirely, an independent emergency account may be needed in order to reach the backup system.

This account;

must be protected offline,

must be used very sparingly,

must be protected with strong authentication

and must be tested regularly.

### The Most Critical Scenario: The Domain Has Been Completely Seized

The organization must test its backup security on this assumption:

**“The attacker is Domain Admin.”**

In that case;

can the backups be deleted?

can the repository be reached?

can the cloud backup be deleted?

can Object Lock be removed?

can the vault be reached?

If the answer is yes, the architecture is not sufficiently isolated.

### The Second Critical Scenario: The Backup Admin Has Been Compromised

A more advanced scenario:

**“The attacker also holds the backup administrator account.”**

In this case the importance of immutable backup becomes evident.

Even with the backup admin account, it must be impossible to delete all the restore points.

### The Third Critical Scenario: Production Is Entirely Gone

The most extreme test:

**The production DC is completely unusable.**

In that case can the organization;

offline backup,

recovery keys,

network config,

AD backup,

application installation files

rebuild the system with these?

Real cyber resilience is measured at this level.

### Conclusion: Ransomware Targets Your Recovery Capability Before Your Data

In modern cyber attacks the backup is no longer a passive tool to be used after the attack.

It is a direct target of the attack chain.

The attacker's aim is not merely to:

**“encrypt the data”**

as an end in itself.

The real aim is:

**“to prevent the organization from returning to its own data.”**

For this reason attackers;

Active Directory,

Domain Admin,

the backup administrator,

the repository,

snapshots,

DR,

cloud backup,

encryption keys

can target layers such as these.

In a modern backup strategy the core assumption must be this:

**The attacker can get into the production environment.**

A stronger assumption:

**The attacker can be Domain Admin.**

And the strongest assumption:

**The attacker will target the backup system as well.**

This is precisely why, in a ransomware-resilient backup architecture;

**Immutable Backup,**

**Air-Gap,**

**Hardened Repository,**

**Identity Separation,**

**MFA,**

**Network Segmentation,**

**SIEM Monitoring,**

#### Clean Room Recovery

and **Restore Testing**

must be addressed together.

Because on the day of the attack what matters is not how many backups you took.

What matters is:

**how many clean backups you have left that the attacker could not reach.**