Ransomware's business model depends on denying victims access to their data. Increasingly, attackers are also going after backups, because a victim with a clean restore point has little reason to pay. According to BleepingComputer, ransomware groups are now specifically targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay.
Kaseya's guidance, as reported, is that backups need to be isolated, immutable, and regularly tested. Isolation means backups are not reachable from the main network. Immutability means that even if attackers gain access, they cannot modify or delete the backup copies. Testing ensures that when the moment comes, the restore process actually works.
The shift is a reminder that backup strategy is no longer just about having copies; it is about making those copies resilient to an adversary who is actively trying to destroy them. Organizations should assume attackers will look for backup stores and plan accordingly.