Technology @ Your Service - KW Corp, Fowlerville, MI
For years, the standard advice about ransomware has been simple: keep good backups, and if the worst happens, restore and move on. That advice is still right. But attackers have read it too. If your backups are the reason you will not pay, then your backups become the first thing they try to take away.
This article looks at what federal advisories say about ransomware groups targeting backup infrastructure, what small and mid-sized businesses in Mid-Michigan should verify, and where a Managed IT partner fits.
What the advisories describe
You do not have to rely on vendor marketing to see this pattern. U.S. government advisories have documented it for years.
Gunra (2026). In August 2026, CISA, the FBI, and partner agencies released a joint #StopRansomware advisory on Gunra ransomware. It states that against one victim, Gunra actors "deleted backup and archived data stored on backup infrastructure at both the primary data center and disaster recovery center before and after the ransomware deployment." The advisory also notes that Gunra actors disable built-in recovery features. Two copies in two locations did not help, because both were reachable.
BlackMatter (2021). A 2021 joint advisory from CISA, the FBI, and NSA described BlackMatter actors using previously compromised credentials and noted: "Rather than encrypting backup systems, BlackMatter actors wipe or reformat backup data stores and appliances." The same advisory reported ransom demands ranging from $80,000 to $15,000,000.
Change Healthcare (2024). This case is a reminder of how attackers get in to begin with. In written testimony to the Senate Finance Committee, UnitedHealth Group's CEO said criminals used compromised credentials on a Change Healthcare remote access portal that "did not have multi-factor authentication," and that ransomware was deployed nine days later. He confirmed the company paid a $22 million ransom.
The cost of getting this wrong is real. IBM's 2025 Cost of a Data Breach Report put the average cost of an extortion or ransomware incident at $5.08 million when the attacker disclosed the breach. Even a fraction of that would be a serious blow for most small businesses.
Why backups become an easy target
The common thread is not a lack of backups. It is that the backups are reachable. In our experience, the typical gaps for small businesses look like this:
- The same administrator account that runs the servers also runs the backup system.
- Backup storage sits on the same network as everything else, with nothing in between.
- The backup console is reachable remotely with only a password.
- Backup software is treated like an appliance and patched last, if at all.
- The only proof of a working backup is a nightly "job completed" email.
- Security monitoring watches workstations and servers, but not the backup system.
None of these are unusual, and none mean someone did a bad job. They are what happens when a small team sets something up once and has no time to revisit it.
Six things to verify this month
1. Keep at least one immutable copy
CISA's Gunra advisory lists this as a key action: "Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment." The BlackMatter advisory defines immutable as backup data that "cannot be altered or deleted." In practice, that means at least one copy, often in cloud storage with object lock or an offline copy, that nobody can delete or change during its retention period, including an administrator. Ask your provider exactly who, if anyone, can shorten retention or remove that copy.
2. Separate credentials and the network path
If one compromised account can reach production and every backup copy, you effectively have one copy. Use dedicated accounts for backup administration that are not used for daily work or tied to your main domain admin. Segment backup storage from the production network, which CISA also recommends to limit lateral movement. The goal: no single identity or connection that can wipe everything.
3. Require MFA on backup consoles and remote access
The Change Healthcare entry point was a remote access portal without multi-factor authentication. CISA's BlackMatter advisory recommends requiring MFA "particularly for webmail, virtual private networks, and accounts that access critical systems." Your backup console is a critical system. So is any cloud backup portal and any remote access tool your vendors use. CISA also recommends time-based, just-in-time access for admin accounts where possible.
4. Patch backup software with production urgency
CISA's Gunra advisory urges organizations to prioritize patching known exploited vulnerabilities in internet-facing systems and to keep all software and firmware up to date. Backup servers, agents, and storage appliances belong in your regular patch cycle, not on the "we will get to it" list.
5. Test restores, not just backups
The Gunra advisory does not just say "have backups." It says implement and test them. A backup job that completes successfully tells you data was copied. It does not tell you whether you can bring a server, a line-of-business application, or a mailbox back in a reasonable time. Schedule real restore tests, write down how long they took, and note what broke. Those notes become your recovery plan.
6. Monitor the backup system itself
Attackers who delete backups usually have to change something first: a deleted job, a shortened retention setting, a new admin account, or a disabled alert. Make sure those events alert someone who will look, after hours included. CISA also recommends reviewing systems for new or unrecognized accounts.
Where a Managed IT provider fits
Most small businesses understand the risk. The hard part is having the time and people to do this work well and keep doing it. That is where a Managed IT partner can help. KW Corp's Managed IT team can:
- Inventory every backup copy, where it lives, and who can reach it.
- Design isolation: separate backup credentials, segmented storage, and at least one immutable copy.
- Put MFA in front of backup consoles and remote access.
- Keep backup software patched alongside everything else.
- Run scheduled restore drills and document the results.
- Monitor the backup environment, not just production.
The goal is simple: if the worst day comes, recovery is a plan you have already practiced, not a hope.
Contact KW Corp to review your backup and recovery setup
KW Corp - Technology @ Your Service
307 W. Grand River Ave, Fowlerville, MI 48836 | 517-223-3610 | support@kw-corp.com