Ask any business owner what happens if ransomware hits tomorrow, and you will usually get a version of the same answer: “We have backups.”
That answer used to end the conversation. Now it starts one, because the people writing ransomware have heard it too. They have heard it so many times that they built an entire phase of the attack around taking it away from you.
Here is the shift most companies have not internalized yet. Encrypting your files is the easy part. Any commodity toolkit can do that in an afternoon. The hard part, the part attackers actually invest time in, is making sure you cannot simply restore and walk away. Your recovery capability is the only thing standing between them and a payday. So that is what they attack first.
Ransom leverage is not built on encryption. It is built on your inability to recover.
Think about what a ransom demand really is. It is a price tag attached to a question: what is it worth to you to get back to normal faster than you could on your own?
If you can restore clean data in six hours, that price tag is close to zero. You do not negotiate. You do not call anyone. You restore, you file an incident report, and you get on with your week.
If your backups are gone, corrupted, or three weeks stale, the price tag is whatever the attacker decides it is. Same malware. Same intrusion. Completely different outcome, determined entirely by the health of a system most companies never think about until the worst possible day.
That is why modern intrusions do not detonate on arrival. Attackers sit inside networks quietly, sometimes for weeks, doing something that looks a lot like an IT audit. They map the environment, find the backup infrastructure, learn the schedule, and figure out exactly what would have to break for recovery to fail. Only then do they pull the trigger.
The five moves attackers make against your recovery
They hunt the backup console before they touch a single file. Backup platforms are a gift to an intruder. One login, and they can see every system you consider valuable, how often it is protected, and where the copies live. Backup admin credentials are often reused, rarely rotated, and frequently exempted from multifactor authentication because the service account “breaks things” when MFA is enforced. That exemption is now one of the most reliable ways into an organization.
They shorten retention instead of deleting backups outright. Deleting every backup sets off alarms. Quietly changing a retention policy from ninety days to seven does not. By the time anyone notices, the only restore points left are the poisoned ones. This is a patient move, and it works because almost nobody monitors configuration changes inside the backup platform the way they monitor changes in production.
They corrupt restore points slowly. If an attacker has been in your environment for six weeks, every backup taken in those six weeks may contain their access. You restore, and you restore them along with your data. Companies that recover successfully and then get hit again a month later usually did exactly this.
They go underneath the file layer. Hypervisor snapshots, storage array replication, and cloud storage buckets are all fair game. Attacking virtualization infrastructure directly takes out dozens of servers and their local copies in a single action, which is far more efficient than encrypting machines one at a time.
They steal your data so recovery does not end the conversation. Even a flawless restore does not undo exfiltration. This is why double extortion became standard. They want a second lever in case the first one fails, and increasingly that lever is a threat to publish client records, contracts, or regulated data. Helixstorm’s guide on how to recover from a ransomware attack walks through why containment and forensic work have to happen alongside restoration, not after it.
Why most SMB backup setups fail this specific test
Very few of these environments are careless. They are just built for the wrong threat.
Backups designed to survive a failed drive, a flooded server room, or an employee deleting the wrong folder are built for accidents. Accidents do not go looking for the backup server. Accidents do not read your runbook in SharePoint. A backup system built for accidents will typically sit on the same domain as everything else, authenticate with the same directory, and be reachable by the same compromised account that started the whole incident.
The uncomfortable question to ask your IT team this week is not “are we backing up?” It is “if an attacker had domain admin right now, what could they do to our backups?” If the honest answer is “delete all of them,” you do not have a recovery plan. You have a copy of your data sitting in the same room as the fire.
What actually holds up under attack
Immutability. A backup that cannot be altered or deleted for a fixed window is the single most valuable control available here, because it removes the attacker’s ability to act on it at all. Not restricted. Not permissioned. Structurally impossible. Helixstorm builds this into its managed backup services using immutable backup targets, air gapped proxies, and offsite cloud copies, so a compromised network does not translate into a compromised recovery path.
A separate identity plane. Your backup platform should not trust your production directory. Separate credentials, enforced MFA, and no shared administrative accounts. Treat that console the way a bank treats the vault, not the way it treats the lobby.
Monitoring the backup system as a security asset. Retention changes, job deletions, failed authentications, and new admin accounts inside the backup platform should generate alerts that a human being actually reads. Attackers count on these events landing in an unmonitored inbox.
Tested restores with a stopwatch. A backup that has never been restored is a theory. Testing tells you your real recovery time, which is usually longer than anyone guessed, and it tells you your order of operations. Helixstorm’s breakdown of the steps for designing a foolproof disaster recovery plan covers how to set realistic recovery time and recovery point objectives before an incident forces you to discover them the hard way.
The takeaway
Backups stopped being a safety net the moment attackers started treating them as the primary objective. They are infrastructure now, and infrastructure that is under active attack has to be defended like everything else you protect.
If nobody at your company can answer how your backups are isolated, who can delete them, and when they were last restored, that is not a technology gap. That is leverage, and it belongs to somebody else.
Helixstorm works with businesses across Orange County, the Inland Empire, and the Temecula Valley to build recovery that holds up when it is targeted on purpose. Request a consultation and find out what your real recovery time looks like before an attacker measures it for you.
