Can backups be infected with ransomware?
Yes, in two different ways. The backup files themselves can be encrypted or deleted if the ransomware or the attacker can reach the backup storage, which is why immutable and offline copies matter. Less obviously, the backups can faithfully contain the attacker's presence: attackers are often inside a network for days or weeks before they encrypt, so recent backups may include their backdoors, scheduled tasks, new admin accounts or malicious files, ready to come back to life after a restore. That is why you keep several restore points over a longer period, restore into an isolated environment first, scan the restored systems, and check for accounts and remote-access tools that should not be there. Knowing when the intrusion actually began, from logs and network history, tells you which restore point is likely to be clean.