Ransomware now pairs encryption with backup sabotage and persistence

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Barracuda's report: Ransomware incidents now combine encryption with backup sabotage, lateral movement and privilege escalation, making recovery harder even when data can be restored from backups.

Why it matters: Ransomware is an identity and resilience problem as much as a malware problem, because attackers exploit privileged access, email exposure and restore-path weaknesses to widen impact.

By the numbers:

• 57% of organisations experienced a successful ransomware attack in the last 12 months.
• 32% paid a ransom, but less than half, 41%, got all their data back.
• 71% of organisations that had experienced an email breach were also hit with ransomware.
• 65% of ransomware victims were able to restore data from backups.

Context

Ransomware is no longer a single-stage extortion event. It commonly combines initial access, credential abuse, network spread and recovery disruption, which means the real control problem is not only stopping encryption but also limiting how far an attacker can move once inside.

For identity and security teams, the important shift is that ransomware now reaches across email, privileged access, endpoint fleets and backup systems. That makes it a governance issue for access, segmentation and restore assurance, not just a malware response exercise.

Key questions

Q: What should teams do immediately after discovering ransomware access?

A: Contain the identity path before focusing on payload cleanup. Disable exposed credentials, revoke active sessions, isolate privileged accounts, and protect backup and security-tool access so the attacker cannot continue moving or block recovery. The urgent goal is to stop further use of legitimate access.

Q: Why do malicious emails so often lead to ransomware or data theft?

A: Phishing works because the email is only the entry point. Once a user clicks a malicious link or opens a harmful attachment, an attacker can gain a foothold and move to the next stage, such as ransomware deployment or data theft. The risk increases when the message looks plausible, creates urgency, or avoids obvious spelling and grammar errors that would otherwise trigger suspicion.

Q: How do ransomware attackers block data recovery?

A: Ransomware attackers block data recovery by deleting backups, encrypting shared storage, corrupting recovery points, and removing Volume Shadow Copies, which are local restore snapshots in Windows. They may also disable backup services, target backup servers first, and wipe online replica copies so defenders cannot roll systems back after encryption.

Q: What is the best way to limit ransomware spread across a network?

A: The best way to limit ransomware spread across a network is to remove standing privilege, segment systems, and restrict lateral movement with least privilege, JIT access, and strong admin separation. Attackers spread fastest when service accounts, remote management tools, and shared local administrator passwords can reach many endpoints without containment.

Technical breakdown

How ransomware uses lateral movement and privilege elevation

Modern ransomware crews often begin with one compromised account or endpoint, then expand through the network by reusing access already granted to legitimate users or administrators. Lateral movement lets them reach additional systems without repeatedly breaking in, while privilege elevation gives them the rights needed to disable security tooling, touch backups or deploy payloads widely. In practice, the attack succeeds when identity controls are too broad, poorly segmented or slow to detect abnormal use of legitimate access.

Practical implication: Limit the blast radius of any single account by tightening privileged access and monitoring for abnormal east-west movement.

Why backup sabotage changes ransomware recovery

Backups only help when the attacker cannot reach, delete or tamper with them before the organisation responds. Ransomware groups increasingly target shadow copies, backup repositories and restore credentials because recovery pressure is what turns encryption into leverage. When backup systems sit inside the same trust zone as production, the attacker is not just encrypting live data but also removing the organisation's fallback path, which increases the chance of payment and prolongs downtime.

Practical implication: Separate backup administration, protect restore credentials and test whether attackers can alter recovery points from a compromised production account.

Why email compromise often precedes ransomware

Email remains a high-value entry path because it gives attackers a route into user trust, session theft and credential capture. Once an email account or adjacent mailbox workflow is compromised, the attacker can use that access to harvest more credentials, stage phishing internally or pivot into systems that trust the user identity. The survey's link between email breach and ransomware is a reminder that identity compromise in one channel often becomes the opening move for a broader extortion chain.

Practical implication: Treat email compromise as a precursor event for ransomware and tighten detection, reset, and containment workflows across adjacent identity systems.

Threat narrative

Attacker objective: The attacker aims to maximise extortion leverage by denying recovery, increasing downtime and forcing payment through combined encryption, theft and restore-path disruption.

1. Entry commonly begins through email compromise, stolen credentials or another initial foothold that gives the attacker legitimate-looking access to the environment.
2. Escalation follows through lateral movement, privilege elevation and the installation of additional payloads that expand control across multiple systems.
3. Impact arrives when data is encrypted, backups or shadow copies are wiped, and the victim loses the ability to restore quickly without paying.

Breaches seen in the wild

• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware has become a recovery-denial campaign, not just an encryption event. The survey shows attackers layering backup wiping, shadow copy deletion and persistence onto the familiar encryption playbook. That changes the control objective from merely containing malware to preserving a recoverable state after compromise. Practitioners should measure whether a ransomware incident can still be rolled back without relying on attacker goodwill.

Email exposure is now a ransomware precursor condition. Barracuda's figures link email breach history with later ransomware impact, which reinforces the role of identity and mailbox governance in extortion risk. The practical lesson is that email security, credential hygiene and access containment sit on the front line of ransomware prevention. Security teams should treat mailbox compromise as an early signal for wider intrusion.

Backup trust is a governance assumption that ransomware routinely breaks. The critical failure is not simply weak backups, but backups that share too much administrative trust with production systems. When restore credentials, backup consoles or snapshot controls are reachable from a compromised account, resilience becomes conditional rather than assured. That is why backup isolation belongs in the same control conversation as privileged access management.

Standing privilege makes ransomware more destructive once an attacker lands. Attackers do not need to invent new access paths when over-privileged accounts already exist. They can move laterally, elevate rights and disable recovery controls using the organisation's own entitlements. For identity programmes, the issue is not only account theft but the speed with which legitimate access can be turned into enterprise-wide disruption.

From our research library:

• Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.

What this signals

Backup recovery has become part of ransomware defence design. Organisations should assume attackers will try to interfere with snapshots, restore points and administrative access to recovery tooling. That means resilience planning must verify not only that backups exist, but that they remain recoverable after an identity compromise.

Email and identity telemetry should feed ransomware readiness. When mailbox anomalies, forwarding-rule changes or suspicious logins appear, defenders should treat them as possible precursor events rather than isolated incidents. The programme implication is to connect identity monitoring, endpoint response and recovery assurance into one incident path.

For practitioners

• Tighten privileged access around recovery systems Separate backup administration from production administration, restrict who can delete snapshots or modify restore points, and review all accounts that can change recovery infrastructure.
• Hunt for pre-ransomware identity signals Correlate mailbox anomalies, impossible travel, suspicious forwarding rules, unusual admin logins and lateral movement patterns so email compromise is treated as an intrusion precursor.
• Test restore paths from a compromised account Run controlled recovery exercises that assume an attacker has one privileged production identity, then verify whether backups, shadow copies and recovery credentials still remain protected.
• Reduce the blast radius of email access Enforce conditional access, step-up verification for risky actions and tighter session controls on mailboxes that can be used as launch points into internal systems.

Key takeaways

• Ransomware now creates operational risk through recovery disruption as much as through encryption itself.
• The survey links successful attacks, email compromise and limited recovery success, showing how identity exposure amplifies impact.
• Defenders need to protect backup trust, reduce privilege and treat mailbox compromise as an early warning signal.

Related NHI Mgmt Group resources: Threat Profiling for Your Organisation Guide · Breach and Attack Simulation (BAS) Guide · Ransomware Basics for Small Businesses Guide · Hardware Security Keys Guide

Key terms

• Ransomware: Ransomware is malicious software or an attack campaign that blocks access to systems or data and then pressures the victim for payment. In modern incidents, encryption is often combined with theft, disruption, and coercion so the attacker can increase leverage before recovery is possible.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Privilege Escalation: An attack technique where a compromised identity, often an NHI with initially limited permissions, exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.
• Shadow Copies: Shadow copies are untracked replicas of sensitive content created in collaboration tools, documents, reports, or archived systems. They matter because redacting the original ticket does not remove the copies that keep the exposure alive.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the resilience issues that ransomware exposes.