GoKawiilRansomware groups increasingly target backup systems before encrypting data, advisories show
Security researchers and government advisories document a shift in ransomware tactics, with groups like BlackMatter and Gunra deliberately locating and destroying backup data before encrypting primary systems. The 2024 ALPHV/BlackCat attack on Change Healthcare exemplified the pattern: inadequate backup isolation contributed to UnitedHealth paying $22 million without recovering its data, with total costs reaching an estimated $1.6 billion. CISA, the FBI, and the NSA have jointly documented these methods across multiple incidents.