Do ransomware gangs go after backups first?
Very often, yes. Before they start encryption, attackers look for the backup server, the backup software console and any snapshots or shadow copies, then delete, encrypt or corrupt them so that the victim cannot recover without paying. MITRE ATT&CK lists this as Inhibit System Recovery (T1490), and the deletion of shadow copies appears in many CISA ransomware advisories. Backup administrator accounts and backup servers joined to the same domain as everything else are common weak points. Defences: keep at least one immutable or offline copy, run the backup system with separate credentials and multi-factor authentication, keep it out of the main domain where possible, and restrict which machines may connect to it. On the network side, connections to the backup server from machines that never normally talk to it are a warning sign. NetSenX's network map shows which hosts reach each server, and unusual internal connections are flagged as possible lateral movement.