Ransomware attackers look for backups before they encrypt. Why do ordinary network-share backups fail, and how does WORM-locked storage protect recovery after an attack?
In a ransomware attack, the first target is not always the files. The attacker first cuts your recovery path. They find, damage or delete the backups. Without backups, paying the ransom becomes the only option.
Short answer
Keep the backup where an attacker cannot delete it with administrator rights. WORM-locked (immutable) storage does this. The lock holds for the retention period even if credentials are stolen.
Do attackers really target backups?
Yes. In Sophos’s 2024 report, 94% of organizations hit by ransomware said attackers tried to reach their backups. 57% of those attempts succeeded.
The result is serious. According to the same report, organizations with compromised backups were almost twice as likely to pay the ransom. Their recovery cost was eight times higher.
Why do ordinary backups fail?
- The backup store is exposed as a network share (NAS/SMB). Ransomware encrypts that share too.
- The backup software is tied to the Domain Admin account. When the attacker takes that account, the attacker also owns the backup software.
- One account can delete data. If that account is stolen, all backups are deleted.
- The backup catalog and the store are on the same network. The attacker damages both together.
How does WORM-locked storage protect you?
WORM means “write once, read many.” After data is written, nobody can change or delete it until the retention period ends. The storage layer enforces this rule. The lock stays even if an administrator account is stolen.
| Feature | Network-share backup | WORM-locked backup |
|---|---|---|
| Can an administrator account delete it? | Yes | No (during retention) |
| Can ransomware encrypt it? | Yes | No |
| Reliable recovery after an attack | Uncertain | High |
| Proof of “unchanged” in an audit | Hard | Easy |
What should you check?
- Lock mode: Prefer “compliance” mode, which nobody can remove, over “governance” mode, which a privileged user can remove.
- Retention period: Attacks can be found late. Choose a period longer than your detection time.
- Separate identity: Keep management of the backup store apart from the Domain Admin account.
- Restore test: Restore from backup on a regular basis. Measure the time.
Where does Moftgate fit?
Moftgate handles ransomware resilience in two layers. The first layer is isolation: the affected device is cut off from the network, and the spread of the attack is limited. The second layer is fast recovery with an immutable, WORM-locked backup.
Important
No backup solution is enough on its own. You also need patch management, separation of privileges and regular restore tests.
The Moftgate engineering team works on endpoint management, data loss prevention and ransomware resilience.
Expert Answers to Core Practitioner Questions
Is WORM the same as an offline backup?
No. An offline backup is physically separate from the network. WORM blocks deletion at the storage layer. You can use both together.
Does a WORM backup fully protect against ransomware?
It protects the backup copy. It does not prevent the attack. It gives you a clean recovery point for the encrypted devices.