Why do newer ransomware families often target backup services and shadow copies first?

Why ransomware groups go after backups and shadow copies first

Ransomware operators usually attack recovery options before or during encryption because recovery is the victim’s strongest negotiating position. If backups, snapshot systems, and shadow copies remain intact, an organisation can restore data instead of paying. Once those recovery paths are removed, the attacker raises downtime, increases operational pressure, and makes the encrypted data far harder to recover quickly.

That sequence is deliberate. Backup repositories often contain the same high-value data the business is trying to protect, and shadow copies may be reachable from the compromised host itself. If an attacker can delete, corrupt, encrypt, or exfiltrate the recovery set, they can turn a disruptive incident into a far more costly one.

What makes backup systems such an attractive first target

Backups are attractive because they concentrate trust and resilience in one place. They also tend to have broad read access, administrative privileges, and automation hooks that make them efficient for operators but dangerous when an attacker gets valid access. A single compromised account can sometimes reach backup consoles, storage buckets, or snapshot controls that were never meant to be interactive during an incident.

Shadow copies and local restore points are even easier to target on the endpoint itself. Attackers do not need to defeat the entire recovery strategy if they can disable the quick path that would let a defender roll the machine back. That is why ransomware playbooks often begin by stopping backup agents, removing volume snapshots, deleting restore points, or tampering with recovery catalogues.

In practice, the goal is not just destruction, but denial of recovery confidence. If defenders cannot trust that their latest restore point is clean, complete, and reachable, they are forced into slower manual validation and broader incident containment before they can restore at scale.

Why this changes the business outcome of an attack

When recovery is blocked, ransomware becomes much more than a file-encryption event. The organisation loses options, including rapid rollback, selective restoration, and clean-room recovery. That stretches outage duration, increases pressure on help desks and operations teams, and can push the incident toward business interruption rather than a contained security event.

Attackers understand that pressure. Removing backups often increases the chance that leadership will consider payment, or at least creates urgency around making operational decisions with incomplete information. Even when a company refuses to pay, recovery without backups is usually slower, more expensive, and more error-prone because every restore path has to be validated under incident conditions.

Risk and Threat Considerations

Backup compromise is dangerous because it attacks both resilience and trust in the recovery process. A defender may still have copies of data, but if those copies are outdated, inaccessible, or possibly tampered with, the practical value of the backup set drops sharply.

Failure mechanism: Ransomware actors remove shadow copies, delete or encrypt backup stores, and target the systems that manage restore permissions so the victim cannot quickly revert to a known-good state.

Impact: Recovery time increases, downtime expands, and the organisation may be forced to rebuild systems from slower, less certain sources while business pressure and extortion leverage rise.

Practitioner Guidance

What to prioritise: Treat backup access and restore authority as part of the attack surface, not just an operations task. The most important control objective is not simply having backups, but preserving at least one recovery path that a compromised production account cannot reach or destroy.

What to verify: Confirm that backups are isolated from everyday admin credentials, that restore credentials are separate from backup-write credentials, and that restore tests prove you can recover under real incident constraints. If the last successful backup is visible but not restorable, it is not a reliable control.

What practitioners underestimate: Shadow copies and snapshot features are often the fastest recovery path, so they are also the first path worth hardening, monitoring, and testing. Ransomware resilience depends on whether recovery survives compromise, not on whether backups merely exist.

Practitioner takeaway: The right question is not whether the organisation has backups, but whether an attacker who lands on one system can also destroy the evidence, the snapshots, and the path back.

Related resources from NHI Mgmt Group

• What breaks when ransomware can delete shadow copies and disable backup services?
• What should security teams do first when ransomware families like Akira target both Windows and ESXi environments in the same attack chain?
• What steps should security teams take to prevent Shadow AI risks?
• Why is visibility important in managing Shadow AI?