Attackers go after backups because backups are what let a victim refuse to pay. CISA's guide says many ransomware variants try to find and then delete or encrypt accessible backups. If your backup is reachable from the network the attacker controls, assume it is a target.
The attacker's logic
A ransom demand only works if recovery looks hard. A victim with a clean, recent copy of the data can rebuild instead of negotiating. So removing that option is part of the plan, and it often happens before the visible encryption starts.
CISA's response checklist tells hunters what to look for: endpoint changes that impair backups, shadow copies, journaling or boot configuration, including misuse of built-in Windows tools such as vssadmin.exe, wbadmin.exe, bcdedit.exe, fsutil.exe and wmic.exe. Those commands are normal admin tools, which is why they are easy to miss.
What "accessible" means
A backup is accessible to an attacker if any of these is true:
- It sits on a network share that a domain account can write to.
- The backup server is joined to the same domain, with the same admin credentials.
- The backup console has no separate MFA.
- A cloud backup can be deleted with the same identity that runs production.
- Snapshots live on the same storage system as the data.
The NCSC points out that backup devices connected to the network are exactly what attackers look for, and that two copies on one removable drive is not enough.
Making a copy hard to reach
- Keep an offline copy. CISA says to maintain offline, encrypted backups of critical data. The NCSC says to keep them separate, in a different location, ideally offsite.
- Separate credentials. The identity that administers backups should not be a day to day domain admin.
- Protect the backup system itself. Patch it and restrict who can reach its management interface.
- Consider more than one cloud. CISA's guide mentions multi-cloud backups as an option.
- Mind compliance. CISA cautions that immutable storage may not satisfy the retention or deletion criteria of certain regulations, so check yours.
Check, do not assume
Run a short exercise. From a normal admin account in your environment, ask: can I delete or alter last night's backup? If yes, so can an attacker who steals that account. Write down who can, then fix the list.
Also scan backups for malware before restoring. The NCSC warns ransomware may have reached backups before it was found.
Quick check
Is a cloud backup automatically safe from ransomware?
No. If the same credentials that run production can delete the backup, an attacker with those credentials can delete it too. Separate the identities and add MFA.
Does an offline backup help if it is never tested?
Much less. Both CISA and the NCSC say to test restores regularly, because a backup you cannot restore is not a recovery plan.
Sources
Last reviewed: 19 October 2026.
