Ransomware has a new target. Is your backup ready?

Ransomware actors now treat backup infrastructure as a primary target rather than an afterthought. The ALPHV/BlackCat group demonstrated this in February 2024 by encrypting Change Healthcare systems after entering through a remote access portal lacking multi-factor authentication; the backups were neither isolated nor robust enough to restore operations, so UnitedHealth paid a $22 million ransom without recovering the data and absorbed an estimated $1.6 billion in total recovery costs. BlackMatter made backup destruction standard operating procedure in 2021, using compromised admin credentials against NEW Cooperative and Crystal Valley farm cooperatives to locate every backup store and appliance on the network, then wipe or reformat them before encrypting production systems. A joint CISA, FBI, and NSA advisory documented this pattern, noting BlackMatter demands have ranged from $80,000 upward.

The strategic implication is sharper payout pressure, not just data loss. Once a backup path disappears, the victim loses the negotiating leverage that recovery provides; attackers know this and sequence destruction before encryption deliberately. Change Healthcare shows the scale of exposure when backups fail - $1.6 billion in recovery costs dwarfs the $22 million ransom, which means the real damage is operational paralysis, not the wire transfer. BlackMatter’s 2021 campaigns against agricultural cooperatives prove that even organizations with limited IT budgets become viable targets when backups sit on the same network as production, making this story more relevant to resource-constrained defenders than many high-profile enterprise breaches.

Defenders should isolate backup stores and appliances from production networks so compromised admin credentials cannot reach them, enforce multi-factor authentication on every remote access portal, and test restoration timelines against encrypted backup scenarios. Hunt for evidence of pre-encryption backup access by auditing admin-level queries to backup data stores and appliances, and monitor for sudden reformats or wipes of recovery points before file-encryption events. The CISA, FBI, and NSA joint documentation of BlackMatter tactics should guide detection rules focused on credential abuse followed by storage-targeted deletion.

Watch for two shifts: first, whether ransomware groups begin targeting cloud-based backup services with stolen API credentials rather than on-network appliances, which would change network-segmentation advice; second, whether new joint advisories document updated ransom-demand ranges or new victim sectors, since a jump beyond the documented $80,000 floor or a move into healthcare infrastructure would raise severity significantly.