For years, the advice on ransomware was simple: keep good backups, and when the bad day comes, restore and move on. That playbook is changing. Attackers have figured out that a clean backup is the single thing standing between them and a payout — so they now go after the backups first.
In August 2026, the FBI, CISA, and a coalition of international agencies published a joint advisory on a ransomware strain called Gunra. In at least one confirmed case, the attackers deleted backup and archived data at both the victim’s primary data center and its disaster recovery site — before and after deploying the ransomware. One set of stolen credentials reached both copies, and both were erased. Having two copies in two locations meant nothing, because both trusted the same key.
That pattern is not unusual anymore. BleepingComputer reported in October 2026 that ransomware groups are increasingly encrypting or deleting backups to wipe out the recovery path, and a real-world case study of a roughly 30-person manufacturing business showed attackers pulling storage keys out of backup software and deleting two offsite cloud copies before locking the production server.
TL;DR
Backups are the first target, not an afterthought. The fix is not more copies in more places — it is making sure no single compromised username can reach every copy, and proving the restores actually work. That is the difference between paying a ransom and walking away from the incident.
Why backups became the target
The logic is simple. Attackers make money when you cannot recover without them. Encrypting the office files is a weak bargaining position if you can restore from a clean backup in a few hours. But if they wipe the recovery copies first, you have no good option except to negotiate.
Modern attacks often spend days or weeks mapping the network before anyone notices. The reconnaissance phase now routinely includes finding backup servers, snapshot schedules, and the administrator account that can reach all of them. When the encryptor finally runs, the backups have already been neutralized.
What “3-2-1” no longer protects you from
The classic rule — three copies, on two kinds of media, one offsite — counts copies and locations. It says nothing about how many sets of credentials can reach every copy. Ransomware groups have figured out that a second location is not a safe location if it accepts the same logins as the first.
Think of it this way: geographic redundancy protects you when the failure is physical — a fire, a flood, a lost laptop. It does nothing when both copies live behind the same username and password. Once the attacker steals those credentials, two locations behave like one system. The Gunra case is the cleanest example of that yet in an official advisory.
What actually stops this
CISA’s guidance for Gunra is worth reading as the blueprint. The key actions, in plain English:
Immutable or offline copies. A backup that cannot be modified, overwritten, or deleted for a set period — even by someone with administrator rights — fundamentally changes the attacker’s math. This is now a baseline, not an advanced feature. Many cloud storage platforms support object lock that does exactly this.
Separate the credentials. If the same account that manages your servers can also reach your backups, you do not have separate protection. Backup admin should use its own accounts and its own authentication, ideally with a login an attacker could not reuse from the main environment.
Patch your backup software like production. Backup platforms and appliances are software too, and attackers reach them when they are left unpatched. They should be on the same patch schedule as your servers — not treated as exceptions.
Test restores, not just backups. An untested backup is an assumption. The industry rule has grown from 3-2-1 to 3-2-1-1-0: three copies, two media types, one offsite, one immutable, and zero errors — meaning you have actually restored and verified, not just watched the dashboard say “success.” Businesses that discover their restores fail while the attack is underway have no time to fix them.
Where to start this week
You do not need a security team to close most of this gap. Three questions will take you far:
Who can reach every backup copy with one login? If the answer is one person and one password, that is your risk.
When did you last do a real test restore — not a backup job that ran, but an actual restore to a real machine? Most businesses have not done one this year.
Is at least one copy something a compromised employee account could not delete? If every copy is deletable by the office admin password, none of them is safe.
The honest summary
Backups are not a comfort blanket anymore; they are a security control, and attackers treat them accordingly. The goal is a recovery path that a fully compromised network cannot touch. That is achievable for a small business with deliberate setup — it just has to stop being an afterthought.
If you would like a second set of eyes on your backup and recovery setup — including whether a single login could reach all your copies — that is a normal part of our free 30-minute IT review.