GoKawiilRansomware groups increasingly target backup systems before encrypting data, advisories show
Security researchers and government advisories document a shift in ransomware tactics, with groups like BlackMatter and Gunra deliberately locating and destroying backup data before encrypting primary systems. The 2024 ALPHV/BlackCat attack on Change Healthcare exemplified the pattern: inadequate backup isolation contributed to UnitedHealth paying $22 million without recovering its data, with total costs reaching an estimated $1.6 billion. CISA, the FBI, and the NSA have jointly documented these methods across multiple incidents.
GoKawiil's interpretation of the reporting above, not reported fact.
These disclosures suggest that traditional backup strategies may no longer provide adequate protection if backups sit on the same network or share credentials with primary systems. Organizations may need to reconsider backup isolation, credential segmentation, and disaster recovery architecture to prevent attackers from reaching recovery points. The scale of the Change Healthcare incident indicates that backup failures can multiply ransomware costs far beyond the ransom itself.
- Ransomware groups like BlackMatter and Gunra are deliberately seeking out and destroying backup infrastructure before encrypting primary data.
- The 2024 Change Healthcare attack cost an estimated $1.6 billion despite UnitedHealth paying a $22 million ransom, partly due to inadequate backup isolation.
- CISA, FBI, and NSA advisories highlight that compromised admin credentials often give attackers access to both primary and backup/disaster-recovery systems.
Western Digital My Book external hard drive — An offline, air-gapped backup drive is one of the simplest defenses against ransomware that specifically targets connected backup infrastructure—if it's not plugged in, attackers can't encrypt it. Keeping a rotating set of external drives disconnected from your network ensures you always have a clean recovery point untouched by network-based attacks.
See Western Digital My Book external hard drive on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-07
Published there as: “Ransomware has a new target. Is your backup ready?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.