Ransomware no longer targets only data. Attackers are increasingly going after backups too

Backups have long been considered the last line of defense in a ransomware attack. If attackers encrypt servers and workstations, an organization can revert to the most recent clean copy of the data. But modern ransomware attacks increasingly anticipate this scenario — which is why attackers try to find, corrupt, or delete backups even before encryption is launched.

This trend was highlighted on May 6, 2026 by BleepingComputer in the piece Why ransomware attacks succeed even when backups exist, which was produced in cooperation with Acronis. So it is not an independent technical analysis of a single incident, but a commercial article from a security and backup solution vendor. However, the techniques described correspond to a broader trend that incident response teams and security authorities have been addressing for some time.

Attackers often reach backups before encryption

According to Acronis, many modern ransomware attacks follow a predictable sequence: initial compromise, credential theft, lateral movement in the network, locating the backup infrastructure, destroying or disrupting backups, and only then deploying the ransomware.

For the victim, this is a crucial difference. If backups exist but are accessible from the same compromised infrastructure, use the same administrative accounts, or are not protected against deletion, they may not actually help during an incident. In such a case the backup system becomes, instead of the last safety net, another target of the attack.

Typical techniques include deleting shadow copies and attacking snapshots

The article describes several ways attackers can disrupt backups. These include, for example, deleting Windows Volume Shadow Copies (VSS), using legitimate administrative tools as part of techniques known as living-off-the-land, targeting hypervisor snapshots in virtualized environments, or abusing API access to cloud backup stores.

This is not just a theoretical scenario. Security reports have long described that ransomware operators often disable security tools, delete recovery options, and try to limit an organization's ability to bring systems back online before encryption. Google Threat Intelligence also stated in its analysis of ransomware incidents from 2025 that in roughly 43% of analyzed cases attackers targeted virtualization infrastructure, an increase from 29% in 2024.

The biggest problem is typically backup availability from the same environment

Acronis lists common weaknesses such as lack of isolation between production and backup infrastructure, shared administrative accounts, absence of multi-factor authentication, overly broad service account permissions, untested recovery processes, and separate tools for security and backup.

In other words: the mere existence of a backup is not enough. What matters is who can access it, whether it can be altered or deleted retroactively, whether it is isolated from the compromised environment, and whether the organization regularly verifies that it can actually restore operations from it.

Immutable backups reduce the risk that an attacker will delete the last clean copy

An important role in defense is played by immutable backups — that is, backups that cannot be modified or removed for a certain period. In this context Acronis mentions, for example, WORM (Write Once, Read Many) storage, time-locked retention policies, protection against API abuse, and enforcement of protection directly at the storage level.

Security authorities recommend a similar principle. CISA has long emphasized in its ransomware guidance the need for regular backups, storing them offline, and testing recovery. The point is to prevent a situation in which an attacker, after compromising an administrator account, gains the ability to remove even the last usable copy of the data.

Acronis reports a 50% increase in ransomware attacks, but the figure should be read as vendor data

Acronis, in its Cyberthreats Report for the second half of 2025, states that ransomware attacks increased by 50% year over year. It also claims that in the second half of 2025 it detected nearly 100 active Ransomware-as-a-Service providers and 34 new groups.

This figure should be taken as data from a specific vendor, not as a universal statistic for the entire market. Still, it fits into the broader picture that ransomware remains one of the most significant threats to organizations and that attackers increasingly combine encryption, data theft, pressure on the victim, and efforts to destroy recovery options.

Backup must be part of the security strategy, not just an IT routine

The main point of the article is simple: backups are not just a technical operational detail but part of the defense against a cyber attack. If they are not protected as thoroughly as production systems, they can fail precisely when they are most needed.

Organizations should therefore address not only whether backups exist, but also whether they are separated from the normal infrastructure, protected by separate accounts and MFA, regularly tested, monitored, and whether at least some of them are immutable or offline.

The BleepingComputer article does not describe a specific attack, victims, or any specific CVE. Its value lies more in reminding readers of a trend that is very important in practice: in a ransomware incident it is no longer enough to ask whether a company backs up. The key question is whether those backups will survive the attack itself.