Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes. Ransomware can reach cloud backups when an attacker obtains an identity, service account, administrator role, encryption key, or management-plane access that can read, alter, retain, or delete recovery data. A cloud location is off-site, but it is not automatically offline, isolated, immutable, or safe from the credentials used in production.
The protection objective is practical: preserve at least one known-good recovery path that a compromise of production cannot readily destroy. That normally requires separate administration, least-privilege access, multiple copies, suitable immutability or version history, encryption, monitoring, and restore tests.
What “cloud backup” does—and does not—mean
Cloud backup describes where data is stored, not how strongly it is protected. A backup service may be reachable through the same identity provider, administrator account, network connection, automation pipeline, or support process used by production systems. If ransomware operators compromise one of those paths, they may be able to discover backup resources, encrypt data, delete recovery points, shorten retention, or disable the jobs that create new copies.
“Off-site” only means the copy is in another location. “Online” means it can be reached through a live connection. “Immutable” means protected data cannot be changed or deleted during a defined retention period. “Versioned” means earlier object versions can be retained and recovered. These properties overlap, but none should be assumed from the word cloud alone.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns that ransomware variants may find and delete or encrypt accessible backups. Its #StopRansomware Guide recommends offline, encrypted backups, regular tests of availability and integrity, least privilege, cloud-to-cloud backups where appropriate, delete protection or object lock, version control, and alerts for abnormal use.
How ransomware can compromise a cloud backup
Stolen or overprivileged identities
An attacker who steals a cloud administrator’s password, session token, API key, or service-account credential may inherit the ability to manage both workloads and backups. Multifactor authentication reduces some account-takeover risk, but it does not correct excessive permissions or a credential that can still delete every copy. Shared administrator accounts also make it difficult to identify which action was legitimate.
A shared management plane
Many environments let the same console or automation account start backup jobs, change retention, and delete recovery points. That is a single destructive path: compromise production, then use the same authority to remove the evidence and the recovery option. Google Cloud recommends a dedicated restricted project for backup vaults and separates the role that triggers backups from the role that can delete backups or modify retention. Its guidance was marked last updated 2026-10-09 UTC; check the page for current service behavior.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Microsoft Azure’s ransomware-resilient backup architecture similarly describes dedicated backup subscriptions separate from workload subscriptions and a second vault in another region. The value is not the product label; it is the separation of authority, account boundary, and recovery location.
Replication that faithfully copies malicious changes
A synchronized or replicated copy is not automatically a historical backup. If ransomware encrypts files and the replication system treats those changes as normal, the encrypted versions can be propagated to the second location. Recovery depends on having object versions, snapshots, retention controls, or another way to select a point before the attack.
Version history can preserve earlier objects, but only if versions are retained and cannot be silently purged. Confirm who can delete old versions, whether lifecycle rules remove them, and how long a known-good version remains available.
Compromised keys or recovery workflows
Encryption protects confidentiality, not availability. An attacker may be unable to read encrypted backups but still delete them, change policies, or destroy the keys required to restore them. Keys, key-management administrators, break-glass credentials, and recovery runbooks therefore need protection and separation comparable to the backup data itself.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Controls that make a recovery copy harder to destroy
| Control | What it helps with | Limit or design decision |
|---|---|---|
| Separate backup account, project, or subscription | Reduces the chance that a production identity automatically controls recovery data. | Use distinct administrators and credentials. Separation is weakened if the same role or secret can operate both environments. |
| Immutable retention or object lock | Prevents protected recovery points from being altered or deleted during the retention period. | Choose the period carefully. Provider locks may be irreversible while active; misconfiguration can increase storage cost or conflict with regulatory requirements. |
| Version history | Provides earlier object versions after accidental or malicious changes. | Versioning alone is not isolation. Verify retention, deletion permissions, and lifecycle rules. |
| Multiple copies and locations | Offers an alternate path if one account, vault, system, or region is unavailable. | Every extra copy adds cost and operations. Copies should not share one destructive credential or policy. |
| Encryption and separate key control | Protects confidentiality and limits who can use backup data. | Safeguard keys and recovery access separately. Encryption does not stop deletion. |
| Monitoring and restore testing | Reveals suspicious activity and proves that recovery is usable. | Tests must include the actual systems, dependencies, credentials, and data the organization must restore. |
CISA’s Play ransomware advisory recommends multiple copies in a physically separate, segmented, secure location and says backup data should be encrypted and immutable. That is organizational guidance, not a guarantee that one configuration defeats every attack.
Build a ransomware-resilient cloud backup design
1. Define what must be recovered
List critical applications, databases, file stores, identity services, configuration, and encryption keys. For each, set a recovery point objective (how much recent data can be lost) and a recovery time objective (how quickly service must return). Those decisions determine backup frequency, retention, number of copies, and whether a second region or offline copy is justified.
2. Map every destructive permission
Inventory human users, service accounts, automation roles, API keys, break-glass accounts, and provider support paths. Identify who can:
- delete a vault, snapshot, object, or backup job;
- shorten or remove retention;
- disable immutability, versioning, or alerts;
- change lifecycle policies;
- access encryption keys; and
- restore data into a production environment.
Remove unused permissions, require strong authentication for administrators, and log policy changes as well as data access. A role that starts a backup job does not need permission to erase its recovery points.
3. Separate administration from production
Create a dedicated backup account, project, subscription, or vault boundary. Give backup operators only the permissions needed to run and inspect jobs. Reserve deletion and retention changes for a separate, tightly controlled role with independent authentication and approval. Keep credentials for that role out of production servers and deployment pipelines.
For critical systems, consider a second administrative boundary or provider account. Geographic separation can help when a region is unavailable, but it does not help if both regions are controlled by the same compromised identity.
4. Add a protected recovery point
Use immutable retention, object lock, delete protection, or equivalent controls where the workload and policy require them. Set retention from the business requirement, not from a convenient default. Before enabling an irreversible lock, verify legal holds, privacy deletion obligations, storage growth, and the process for recovering during an incident.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Where immutability is unavailable, combine version history with restricted deletion permissions and a separately administered copy. Test whether an administrator who controls production can still purge every version; if so, the design has not achieved meaningful isolation.
Recommended Free Tools
5. Keep more than one copy
Maintain copies across independent failure domains when the impact of losing one vault justifies the cost. A second cloud region, separate cloud account, cloud-to-cloud copy, or disconnected physical medium can provide another recovery route. An external hard drive that is disconnected and stored securely can be one additional offline copy, but it does not make the cloud backup safe by itself and must be encrypted, cataloged, and tested.
6. Protect keys and recovery credentials
Store encryption keys under a separately governed key-management configuration when practical. Limit who can export, destroy, or rotate keys, and document how a break-glass recovery works. Keep an emergency credential available through a controlled process rather than on the same administrator workstation that manages production.
7. Monitor for destructive behavior
Alert on unusual download or deletion volume, mass object changes, disabled backup jobs, retention-policy edits, new administrators, key-destruction attempts, and failed backup runs. Send logs to a location whose retention cannot be changed by ordinary production administrators. Monitoring is useful only if someone is assigned to investigate and act on alerts.
8. Test restoration, not just backup completion
A successful job status proves that a job ran; it does not prove that the data is intact, that the required version still exists, or that the organization can rebuild the service. On a schedule appropriate to the system’s criticality:
- Select a known-good recovery point and record why it predates the test or an established clean baseline.
- Restore into an isolated account, subscription, project, or network so the test cannot overwrite production.
- Verify files, database consistency, application configuration, permissions, dependencies, and encryption-key access.
- Measure elapsed time and document manual steps, missing credentials, and capacity limits.
- Record the result, fix failures, and repeat after major provider, policy, or application changes.
CISA states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” The recommendation appears in its #StopRansomware Guide and applies to the recovery process, not merely to storage selection.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Provider-specific implementation notes
AWS
AWS Prescriptive Guidance describes immutable storage and AWS Backup Vault Lock as protections for recovery points during a required retention period. The guidance notes a cooling-off period before a vault is permanently locked. Treat retention duration, deletion behavior, cost, and regulatory fit as design questions; the page does not establish compliance with every assessment.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Read the current AWS Prescriptive Guidance on safeguarding backups and verify the exact service, account, and Region settings you will use.
Google Cloud
Google Cloud’s Backup and DR guidance recommends a dedicated restricted backup project, separate permissions for creating backups and deleting them or changing retention, locked minimum retention, encryption options, access restrictions, and monitoring. Confirm which controls apply to the specific backup service and resource type in your project.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use the current Google Cloud ransomware best-practices documentation when implementing or reviewing the design.
Microsoft Azure
Microsoft Learn recommends separate backup subscriptions and regions and locked immutable recovery points. It says locking immutability is one-way during retention and advises validating retention against business and compliance requirements first.
Consult Microsoft’s ransomware-resilient backup architecture for the current subscription, vault, and region pattern.
Questions to answer during a security review
- Can a compromised production administrator delete, alter, or shorten retention on every backup?
- Do backup jobs use credentials that also log in to production servers?
- Are old object versions protected from lifecycle deletion?
- Is at least one copy outside the primary account, project, subscription, or region?
- Can the organization restore without access to the compromised identity system?
- Are encryption keys, break-glass credentials, and audit logs governed separately?
- When was the last isolated restore, and what evidence shows that the recovered application actually worked?
If any answer is unknown, treat the backup as unproven rather than assuming the cloud provider will preserve it. Provider features change, and exact retention, region, and compliance behavior must be checked in the documentation for the service and account configuration in use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do if ransomware is suspected
- Isolate affected endpoints and workloads according to the organization’s incident-response plan; avoid wiping evidence before it is collected.
- Protect backup administration immediately by disabling suspected credentials and using a separately controlled emergency account.
- Pause replication or synchronization that could copy encrypted or malicious changes into clean copies, but preserve logs and document the decision.
- Identify the last known-good recovery point from immutable records, version history, offline media, or an independent copy.
- Restore into an isolated environment first, validate integrity, rotate exposed credentials and keys, and only then plan a controlled return to production.
Do not assume that a visible backup catalog is trustworthy if the attacker controlled its administration. Corroborate recovery points with immutable retention records, independent logs, or a separately governed copy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
