Ransomware attacks often look chaotic, but they rarely are. Almost every successful incident follows a clear sequence of phases, known as the cyber kill chain. One thing has changed decisively in recent years: backups are no longer a neutral safety net that attackers leave alone. They have become a target themselves.
Why backups became a preferred target
A study by the Enterprise Strategy Group shows that at 96 percent of companies hit by ransomware in the past two years, the backup systems were attacked as well. In more than half the cases, nearly all attack attempts additionally targeted the data protection. The reason is obvious: anyone who can restore their data from an intact backup has no incentive to pay a ransom. Attackers know this and have adjusted their approach accordingly.
The phases of the kill chain
It starts with reconnaissance and initial access, usually via phishing, stolen credentials, or openly reachable RDP access. Even at this early stage, experienced attackers look specifically for clues about the backup infrastructure, for example through network scans that reveal services like Veeam, Backup Exec, or Commvault.
Next come lateral movement and privilege escalation. Backup servers are a preferred intermediate target here, since they're often domain-joined, hold far-reaching access rights to the storage infrastructure, and in practice are frequently hardened less than production systems. According to the current CrowdStrike Global Threat Report, the average breakout time, meaning the time between initial access and first lateral movement, dropped to 29 minutes in 2025, down from 48 minutes the year before. Such a narrow window leaves little room for manual response. The attackers then use command and control to establish a covert channel to their infrastructure.
The critical point: destroying recovery
Before the actual encryption begins, modern ransomware families systematically try to destroy every recovery option. Documented cases like the Dire Wolf family show how this works: legitimate Windows tools are used to delete shadow copies, stop backup jobs and remove existing backups, disable the Windows recovery environment, and clear event logs. On top of that, processes and services of backup and security solutions are deliberately terminated.
What's notable: no classic malware is needed. All the commands are regular, Microsoft-signed built-in tools, cataloged in the MITRE ATT&CK framework as technique T1490 and also known as a living-off-the-land technique. Because these tools also run in normal admin work, pure signature detection is powerless. What matters is the context, such as which account calls the commands and whether that happens outside the scheduled backup windows. Only then comes the encryption, often combined with prior data exfiltration as double extortion.
Beyond outright deletion, analysts increasingly observe subtler tactics. Instead of removing whole backups, some attackers deliberately alter just a few bits in the backup files. That's hard to spot and often only shows up in an emergency, when the restore fails. Another pattern involves vulnerabilities in the backup software itself: unpatched backup servers reachable from the internal network are an attractive entry point.
How to make data protection more resilient
The old rule of thumb that working backups automatically protect against ransomware is outdated. A single backup reachable from the production network is itself part of the attack surface today. Several conclusions follow from the observed patterns:
- Immutability: storage solutions with retention lock or object lock prevent written data from being changed or deleted within a defined period, regardless of an attacker's privileges.
- Air gap and cyber vaults: physically or logically separated storage areas reachable only during defined time windows evade lateral movement.
- A strict 3-2-1 rule: at least three copies on two media types, one of them outside the production network.
- Hardening the backup infrastructure: network segmentation, restrictive firewall rules, and separate administrative accounts reduce the attack surface.
- Behavior-based detection: a baseline for normal backup behavior helps spot deviations early.
- Regular restore tests: only tested backups are reliable in an emergency.
The kill chain shows that protecting backups must be considered from the start, not at the end. Anyone who treats their data protection only as a last resort, rather than as an independent target to be actively defended, may end up facing an empty vault when it matters.