How ransomware finds your backups before it encrypts you
Modern attacks go looking for the backup first, because a business that can restore does not pay. Here is the order it happens in, and where it can be stopped.
There is a common mental picture of ransomware: an email is opened, files start turning into gibberish, a ransom note appears. The real sequence is slower and more deliberate, and understanding it explains why so many businesses lose their backups on the same day they lose everything else.
The order it usually happens in
- Entry. A phishing attachment, a reused password, or an exposed remote-desktop service.
- Quiet time. Days or weeks of looking around. Nothing is encrypted yet, because encryption is loud.
- Credential collection. Saved passwords, mapped drives, service accounts, anything with a stored login.
- Backup hunting. Network shares, NAS boxes, backup software consoles, cloud sync folders. Whatever can be reached is deleted or encrypted first.
- The loud part. Only then are your files encrypted and the note left behind.
Step four is the business decision. An attacker knows that a company with a working restore path negotiates from a completely different position — so removing that path is worth the extra week of patience.
What is reachable is what is lost
The single most useful question about any backup is: can the infected machine reach it? If a workstation can browse to it, open it, or log in to it, then so can whatever is running on that workstation with the same rights.
That rules out more than people expect: mapped drives, a share on the file server, a NAS with credentials saved in the backup job, and a cloud sync folder that mirrors deletions upwards.
What actually holds
- No path from the machine to the copy. The backup destination is not something the operating system can see as a drive or a share.
- Credentials the machine does not hold. If it cannot authenticate, neither can the malware wearing its face.
- History that cannot be rewritten. Retained older versions mean encrypting today does not remove last week.
- Noticing the strange. A backup job that suddenly reports far more changed data than usual is often the earliest visible signal of encryption already under way.
If it has already happened
Disconnect the affected machines from the network but do not wipe them, and do not pay anything yet. What is recoverable depends entirely on what was reachable, and that is worth establishing before any money moves. If we can help, ask — even if you are not a customer.