# Do ransomware gangs go after backups first?

Very often, yes. Before they start encryption, attackers look for the backup server, the backup software console and any snapshots or shadow copies, then delete, encrypt or corrupt them so that the victim cannot recover without paying. MITRE ATT&CK lists this as Inhibit System Recovery (T1490), and the deletion of shadow copies appears in many CISA ransomware advisories. Backup administrator accounts and backup servers joined to the same domain as everything else are common weak points. Defences: keep at least one immutable or offline copy, run the backup system with separate credentials and multi-factor authentication, keep it out of the main domain where possible, and restrict which machines may connect to it. On the network side, connections to the backup server from machines that never normally talk to it are a warning sign. NetSenX's network map shows which hosts reach each server, and unusual internal connections are flagged as possible lateral movement.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/do-ransomware-gangs-go-after-backups-first

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/detect-lateral-movement-c2-beaconing

## Related questions

- [Why is a backup mapped as a network drive a risk?](https://netsenx.com/en/faq/why-is-a-backup-mapped-as-a-network-drive-a-risk)
- [Which computers should be able to connect to the backup server?](https://netsenx.com/en/faq/which-computers-should-connect-to-the-backup-server)
- [Can backups be infected with ransomware?](https://netsenx.com/en/faq/can-backups-be-infected-with-ransomware)
- [How do we restore from backup safely after ransomware?](https://netsenx.com/en/faq/how-to-restore-from-backup-safely-after-ransomware)
- [In what order should systems be restored after an attack?](https://netsenx.com/en/faq/in-what-order-should-systems-be-restored)