Actor Profile

This analysis covers a tactical shift across multiple ransomware groups rather than a single named threat actor. Groups including ALPHV/BlackCat, BlackMatter, and Gunra have adopted backup destruction as a standard component of their operations. Their motivation is financial: by eliminating recovery options, they remove the victim's ability to refuse ransom demands, significantly increasing payment pressure. These groups operate as financially motivated cybercrime organizations, often demanding payments ranging from $80,000 to $15 million in cryptocurrency (Bitcoin and Monero). The shift represents an evolution in ransomware tradecraft focused on maximizing leverage rather than simply encrypting data.

TTPs (Tactics, Techniques, Procedures)

Ransomware groups employ several key techniques to neutralize backup infrastructure: Initial access via compromised remote access portals lacking multi-factor authentication (ALPHV/BlackCat case); credential compromise to obtain administrative access to both production and backup environments; reconnaissance to locate backup data stores, appliances, and disaster recovery sites across the network; deliberate destruction of backups through wiping, reformatting, or deletion before deploying encryption payloads; exploitation of unpatched vulnerabilities in backup software (Akira airline attack exploited a vulnerability with available patches for over a year); lateral movement using single sets of stolen credentials to reach both primary data centers and disaster recovery sites. The attack chain prioritizes backup destruction before final encryption, transforming backups from safety nets into initial targets.

Targets & Patterns

Targets span critical infrastructure and service sectors where operational disruption creates maximum pressure. Documented victims include healthcare organizations (Change Healthcare, resulting in $1.6 billion recovery costs), agricultural cooperatives (NEW Cooperative in Iowa, Crystal Valley in Minnesota), and aviation infrastructure. The targeting pattern focuses on organizations with: shared network architecture between production and backup systems, weak credential isolation allowing single compromised accounts to access multiple recovery points, unpatched backup infrastructure, and minimal monitoring of backup environments. Organizations with geographically distributed disaster recovery sites remain vulnerable when those sites trust the same credentials or network pathways. The selection criteria prioritize victims whose business models cannot tolerate extended downtime, making them statistically more likely to pay ransoms when recovery options are eliminated.

Historical Context

The February 2024 ALPHV/BlackCat attack on Change Healthcare marked a high-profile demonstration of backup targeting, resulting in a $22 million ransom payment that failed to recover data and $1.6 billion in total costs. BlackMatter ransomware group established backup destruction as standard operating procedure in 2021 attacks against agricultural cooperatives, prompting joint documentation by CISA, FBI, and NSA. By August 2026, the Gunra ransomware advisory from CISA and FBI confirmed the tactic had evolved further, with attackers systematically deleting backups at both primary and disaster recovery sites using single credential sets. IBM's 2025 Cost of a Data Breach Report quantified average ransomware incident costs at $5.08 million, while 2026 research showed 41% of incidents now include reputational damage threats. This progression demonstrates a maturation from opportunistic encryption to deliberate, multi-stage operations that eliminate recovery paths before final payload deployment.

Defensive Recommendations

  • Implement immutable backup storage using write-once configurations (object lock features) that prevent alteration or deletion even by administrators with compromised credentials
  • Enforce true network and credential isolation for backup infrastructure—separate backup environments from production networks and require distinct administrative accounts with mandatory multi-factor authentication
  • Establish patch management parity by treating backup software and appliances with the same urgency as production systems, addressing known vulnerabilities within standard patch cycles
  • Deploy monitoring and logging specifically for backup infrastructure with alerting on unauthorized access attempts, configuration changes, and deletion operations
  • Conduct regular backup restoration testing under adversarial conditions to validate that recovery processes function when primary and secondary sites are assumed compromised