{"id":368,"date":"2026-10-19T06:09:00","date_gmt":"2026-10-19T13:09:00","guid":{"rendered":"https:\/\/blog.canutethegreat.com\/index.php\/2026\/10\/19\/backups-an-attacker-cant-delete\/"},"modified":"2026-10-20T20:28:52","modified_gmt":"2026-10-21T03:28:52","slug":"backups-an-attacker-cant-delete","status":"publish","type":"post","link":"https:\/\/blog.canutethegreat.com\/index.php\/2026\/10\/19\/backups-an-attacker-cant-delete\/","title":{"rendered":"Backups an attacker can’t delete"},"content":{"rendered":"

Part 1 of 3 in the Surviving ransomware series.<\/em><\/p>\n

Modern ransomware crews don’t start by encrypting things. They start by finding your backups. The playbook described in incident reports from the last few years is depressingly consistent: get domain admin, locate the backup server, delete the restore points or wipe the repository, and only then run the encryptor. If the backups survive, the ransom demand is a negotiation. If they don’t, it’s a hostage situation.<\/p>\n

So the question for this series isn’t “do we have backups?” Almost everyone does. It’s whether an attacker who holds your most privileged credentials can destroy them.<\/p>\n

3-2-1 was written for a different threat<\/h2>\n
\"Backup<\/figure>\n

The classic 3-2-1 rule says three copies of your data, on two different types of media, with one copy offsite. It’s a great rule for fires, floods and failed RAID controllers. It says nothing about an adversary who logs in with valid credentials and deletes all three copies, because in most environments the same admin accounts can reach all of them.<\/p>\n

The extension you’ll often see now is 3-2-1-1-0. The extra 1 is a copy that is offline, air-gapped or immutable. The 0 is zero errors when you verify a restore. I like it because both additions target the actual failure modes: deletion by a privileged attacker, and backups that turn out to be unrestorable on the worst day of your year.<\/p>\n

The backup system is a target in its own right<\/h2>\n

Backup servers are attractive because they hold everything and they usually hold credentials to reach everything. CVE-2023-27532 in Veeam Backup & Replication is a good illustration. It let an unauthenticated user who could reach the backup service port pull encrypted credentials out of the configuration database. It was exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog in August 2023.<\/p>\n

The lessons I take from it are architectural rather than vendor-specific:<\/p>\n