When ransomware encrypts your backups: a complete response strategy

Modern ransomware actively hunts for connected storage, mapped drives, and backup repositories before encryption begins. Once a backup is locked, the traditional safety net disappears and victims face harder decisions about payment or restoration.

This shift is a direct response to better cyber hygiene. As more Australian organisations adopt the Essential Eight recommendations, attackers undermine stored snapshots to maintain leverage. Even companies with solid backup regimes can find their recovery options wiped out overnight.

Australia has seen a sharp rise in this pattern, with the Australian Cyber Security Centre logging a new report every six minutes through 2023 and 2024. Small businesses in Melbourne, Brisbane, and regional towns have been hit particularly hard, often relying on a single on-site NAS or shared cloud account.

Knowing what to do in those first hours is critical. Panic decisions can permanently destroy evidence or lock out legitimate recovery paths, so a calm, structured approach protects both data and future legal options.

How backup-targeted ransomware reaches its goal

Attackers usually gain access through phishing emails, stolen remote desktop credentials, or by abusing legitimate admin tools. Once inside, they map the network quietly, identifying domain controllers, file servers, and backup consoles. Tools like Veeam, Acronis, and Windows Server Backup are then disabled, their credentials stolen, or repositories directly encrypted.

A common technique involves deleting Windows shadow copies and clearing VSS snapshots before the main payload runs. For businesses running hybrid environments across Sydney and Perth, the risk multiplies when replication between sites is left enabled during the attack window.

First response steps within the first 24 hours

Disconnect affected systems from the network immediately, but do not power them off. Running machines preserve volatile memory evidence that may help forensic analysts identify the strain. Photograph ransom notes, log screens, and unusual file extensions before making any changes.

Notify your internal IT or managed security provider as soon as possible, even if the impact seems minor. Many ransomware families sleep for hours after initial deployment, so a single infected laptop in Adelaide may be the visible tip of a wider intrusion.

Preserve logs from firewalls, VPNs, and backup software in their original format. If your business falls under the Notifiable Data Breaches scheme, the 72-hour assessment clock starts the moment you become aware of the incident.

Recovery options when your backups are already locked

Start by checking whether any backups remain untouched. Air-gapped drives rotated off-site, immutable object storage with versioning enabled, or tapes in a secure facility may still be viable. Cloud snapshots taken before the attack window can also help, provided the attacker did not reach the cloud console.

When no clean backup exists, recovery becomes a forensic and negotiation challenge. Threat intel feeds and the No More Ransom project sometimes provide a free decryptor for older strains. For newer families, third-party recovery firms occasionally succeed in partial restoration.

Recovery option	Typical speed	Skill required	Cost estimate (AUD)	Best use case
Clean local backup verified offline	Hours	Low	$0–$500 (labour)	Small offices with disciplined rotation
Cloud snapshot rollback (immutable)	Hours to one day	Medium	$200–$2,000	Hybrid environments with versioning
Free decryptor from No More Ransom	Days to weeks	Medium	$0	Older strains, limited scale
Third-party recovery specialist	One to three weeks	High	$5,000–$50,000+	Large or complex environments
Negotiated or paid decryption	Days to weeks	High	Variable, often six figures	Last resort with legal review

If ransom payment enters the conversation, seek legal advice first. Paying does not guarantee decryption, and Australian authorities advise that any payment should be reported. Remember that removing hidden adware and other post-intrusion payloads are often part of the broader recovery.

Reporting the incident in Australia

Report the attack to ReportCyber, the federal online portal run by the Australian Cyber Security Centre. The report feeds into national intelligence and may connect your case to others targeting the same sector, such as healthcare or professional services in Victoria and Queensland.

If personal information is involved, assess your obligations under the Notifiable Data Breaches scheme. The Office of the Australian Information Commissioner provides clear guidance on when and how to notify affected individuals. Failing to notify can carry civil penalties and lasting reputational damage.

Consider engaging a local incident response firm listed by the ACSC. Sydney and Melbourne host several well-regarded providers who understand both the technical and regulatory environment. They can also coordinate with the Australian Federal Police when criminal activity is suspected.

Hardening backups against future attacks

Adopt the 3-2-1-1-0 rule: three copies of data, on two different media, with one off-site, one immutable or air-gapped, and zero errors on recovery testing. Immutable storage prevents deletion or modification for a set retention period, even by administrators.

Segment backup infrastructure from the production network. Backup servers, consoles, and credential stores should sit behind dedicated VLANs with strict egress filtering. Service accounts should have no domain admin rights, and credentials should be vaulted and rotated frequently. Following practical security tips and tricks for backup hygiene can close many of the gaps ransomware operators exploit.

Test restores every quarter, not just backup success. A backup never restored is little better than no backup. Combine these controls with phishing simulations, privileged access reviews, and offline procedures so that when the next attack arrives, your recovery plan is already proven.

Practical recommendations for Australian teams

• Maintain at least one backup copy on media that never touches the production network, such as rotated USB drives or LTO tapes stored securely off-site.
• Enable immutable versioning on all object storage used for backups and lock the retention period longer than your worst-case dwell time.
• Restrict backup software service accounts to the minimum permissions required and monitor their activity for unusual file access patterns.
• Schedule quarterly restore drills that simulate full network loss, not just single-file recovery, and document the time taken end to end.
• Subscribe to ACSC threat advisories and configure your SIEM to alert on the IOCs published for active ransomware families.
• Keep an offline copy of your incident response plan, contact list, and ReportCyber reference number in a sealed envelope at a secondary site.
• Audit third-party access quarterly, as supply chain compromises remain a recurring entry point in Australian incidents.