iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, ransomware can delete or encrypt backups that are reachable through ordinary accounts, but “first” is not universal. CISA says many variants search for accessible backups and then delete or encrypt them, potentially removing your easiest recovery path. Detection can expose precursor malware, stolen credentials, lateral movement or backup tampering before a full deployment, but no control guarantees advance warning.
The practical answer is to combine offline, encrypted and regularly restored backups with layered endpoint, identity and network monitoring. This guide explains how to design that combination, what alerts matter, and how to recover without reintroducing the attacker.
Can ransomware really delete backups before encrypting other data?
It can target backups early when those copies are connected and writable, but an attacker’s sequence varies. CISA’s #StopRansomware Guide states: “It is important that backups are maintained offline, as many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” That is a warning about a common capability, not proof that every ransomware operation attacks backups first.
Backups are especially attractive because destroying them increases pressure to pay. An intruder who has administrator credentials may enumerate backup servers, snapshots, hypervisor stores, cloud consoles and synchronization jobs. They may disable agents, remove retention points, encrypt repositories or use the same credentials to alter both production and backup systems. A backup that exists but cannot be trusted or restored is not a recovery control.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The exposure depends on reachability. A repository that accepts connections from production servers, shares their directory credentials or has a permanently mounted drive is part of the same attack surface. An offline or separately isolated copy is outside the normal path and therefore much harder to change remotely.
How would I know ransomware is preparing to attack backups?
You need multiple signals because the final encryption event may be late in a broader compromise. CISA recommends centrally managed antivirus with escalated warnings, application allowlisting and/or EDR, network monitoring for command-and-control and lateral activity, and log review. Route alerts to people who can act, rather than leaving them in an unattended console.
| Signal source | Suspicious activity to watch | Useful response |
|---|---|---|
| Endpoint protection and EDR | Unusual scripting, security-tool tampering, mass file changes, new services, credential dumping or connections to uncommon hosts | Isolate the endpoint, preserve evidence and block the process or account |
| Identity and access logs | Privileged sign-ins at unusual times, impossible travel, new administrator accounts, repeated failures or backup-console access from a workstation | Disable or rotate the account, revoke sessions and require an out-of-band approval for recovery changes |
| Backup-platform logs | Retention-policy changes, deletion of snapshots, disabled jobs, repository encryption, agent removal or a sudden increase in failed backups | Freeze destructive actions, protect logs and verify the last known-good restore point |
| Network and firewall telemetry | Scanning, remote-service use, abnormal east-west traffic, command-and-control patterns or a host contacting many backup systems | Segment the host or subnet and investigate lateral movement |
| File and storage telemetry | Rapid extension changes, entropy spikes, mass renames or writes outside a normal backup window | Stop the job or share, quarantine the source and compare with immutable or offline copies |
The joint CISA, FBI and MS-ISAC Phobos ransomware advisory specifically recommends logging and reporting network traffic, including lateral movement. It notes that EDR can reveal both common and uncommon host connections. Exercise these controls against relevant attacker behaviors; an alert that has never been tested may fail when you need it.
Recommended Free Tools
Detection is not a promise of prevention. A ransomware deployment can be the last stage of an intrusion, so an alert should trigger a search for earlier malware, persistence, stolen credentials and changes to backup infrastructure.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
What backup design prevents a single compromised account from destroying every copy?
Use more than one recovery layer, with at least one copy unavailable to ordinary production credentials. CISA recommends offline, encrypted backups, regular restoration tests and golden images for critical systems. It also advises considering immutable storage, while warning that cloud immutability can create compliance limitations and significant cost when configured incorrectly.
| Design choice | Protection it provides | Risk or trade-off |
|---|---|---|
| Offline copy | Cannot be modified through a live network session while disconnected | Recovery is slower; someone must reconnect it under controlled procedures |
| Isolated credentials and network | Separates backup administration from everyday workstation and domain compromise | Requires separate identity management, segmentation and monitoring |
| Immutable retention | Prevents deletion or alteration during a defined retention window | Misconfiguration can increase storage cost or conflict with compliance and deletion requirements |
| Encryption in transit and at rest | Reduces exposure if media or storage is stolen | Lost keys can make an otherwise intact backup unusable; key recovery must be tested |
| Golden images | Provides a known baseline for rebuilding critical systems | Images must be patched, documented and protected from unauthorized replacement |
| Multiple storage locations | Limits the effect of one site, account or platform failure | More copies mean more inventory, testing and access controls |
Judge an architecture by whether an attacker using a production administrator account can discover, authenticate to and delete every copy. If the answer is yes, add separation before buying more capacity.
How do I build an offline and recoverable backup plan?
Implement the controls in an order that preserves a usable restore path, not merely a large archive.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory critical services and data. Identify systems that must return first, their dependencies, recovery owners and the maximum acceptable data loss. Include identity, configuration, databases, file shares, SaaS exports and security tooling.
- Create at least one disconnected copy. Schedule a copy to encrypted removable media or an isolated repository, then disconnect or unmount it when the job is complete. A physical “external hard drive for offline backups” is only a medium; it is not ransomware-proof and does not replace broad organizational coverage.
- Separate administration. Use dedicated backup accounts, multifactor authentication where supported, least privilege and a management network unavailable to ordinary user devices. Do not reuse domain-wide administrator credentials for backup jobs.
- Set retention and immutability deliberately. Choose a retention window that covers your detection and investigation time. Document who can change it, how changes are logged and how legal or regulatory deletion requirements are handled.
- Encrypt and protect keys. Keep encryption keys or recovery credentials under a separate access policy, with a tested emergency retrieval process. A backup that cannot be decrypted is not a successful backup.
- Maintain golden images. Store clean operating-system and application baselines separately from routine data backups. Record patch levels, drivers, configuration and the steps needed to rebuild each critical service.
- Document dependencies and runbooks. Write the exact order for restoring identity, networking, storage, applications and user access. Keep a paper or otherwise out-of-band copy for an outage in which normal systems are unavailable.
How often should backup restoration be tested?
Test availability and integrity through an actual disaster-recovery scenario, not only a successful job report. A green backup status proves that data was written; it does not prove that the files are complete, keys work, applications start or permissions are correct.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Select a representative critical service and a defined restore point.
- Restore it into a clean, isolated network or replacement hardware; do not connect a potentially compromised system to production.
- Verify decryption, database consistency, application startup, identity dependencies and user-access permissions.
- Measure elapsed time, staff actions, manual decisions and data loss against your recovery objectives.
- Record failures, correct them and repeat the exercise after major platform or configuration changes.
Keep test evidence, including which copy was used and who approved reconnection. Rotate through critical systems so an untested dependency does not become the reason recovery stops.
Which detection controls should a small or midsize team prioritize?
Prioritize controls that produce actionable alerts and cover both endpoints and the paths an attacker uses to reach backups. A smaller team can start with centrally managed endpoint protection and reliable log forwarding, then add deeper visibility as staffing and budget allow.
- Endpoint layer: Enable real-time antivirus, tamper protection, suspicious-script detection and EDR where available. Configure alerts to reach an on-call owner.
- Application layer: Use allowlisting on critical servers when operationally feasible, with a change process for legitimate software.
- Network layer: Monitor remote administration, unusual east-west connections, scanning and command-and-control indicators. Restrict backup management interfaces to approved hosts.
- Identity layer: Alert on privileged logins, new accounts, multifactor changes, disabled security controls and access to backup consoles from user endpoints.
- Backup layer: Forward job, retention, deletion and repository-access logs to storage that attackers cannot rewrite from the same account.
- People and process: Define who can isolate a host, disable an account, pause a backup job and authorize restoration. Exercise those decisions with realistic scenarios.
The Phobos advisory recommends exercising security controls against the threat behaviors it describes and analyzing their performance. Tune thresholds after each exercise so frequent legitimate administration does not hide a destructive change.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What should I do when a backup-deletion or ransomware alert fires?
Move quickly, but preserve evidence and avoid actions that spread the compromise. CISA advises triaging affected systems, inspecting logs and detection systems for earlier activity, hunting for suspicious account, endpoint and backup changes, and recovering on a clean network.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Validate and scope the alert. Identify the host, account, process, time, affected repositories and whether encryption or deletion actually occurred.
- Contain access. Isolate affected endpoints and restrict backup-management paths. Disable or rotate suspected credentials and revoke active sessions.
- Preserve evidence. Export relevant endpoint, identity, network and backup logs. Do not erase or rebuild a system before investigators capture volatile information when feasible.
- Investigate the timeline. Hunt for precursor malware, persistence, lateral movement, remote-service use and earlier backup changes. A visible ransomware binary may not be the initial entry point.
- Protect remaining copies. Disconnect offline media if it is currently attached, lock down immutable repositories and verify that retention settings have not changed.
- Communicate out of band. Use a trusted channel if normal email or collaboration accounts may be compromised. CISA warns that an actor who realizes they have been detected may move laterally or deploy ransomware more widely.
- Rebuild cleanly. Restore prioritized services on a clean network from offline encrypted backups or known-good images. Reconnect only systems that have been investigated, rebuilt and monitored.
- Validate before reopening. Check security tooling, credentials, patches, application integrity and logging before allowing normal users back in.
Do not treat “power everything off” as a universal first move. CISA notes that powering down can destroy volatile evidence and should be considered only when network disconnection is not possible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should I compare cloud, local and immutable backup options?
No single medium is automatically safe. Compare the operational properties that determine whether you can still restore after an identity or infrastructure compromise.
| Question | What a strong answer looks like | What to verify before relying on it |
|---|---|---|
| Can production credentials reach the copy? | No; access is isolated, time-limited or offline | Test with a compromised-user scenario and review actual permissions |
| Can an attacker delete retention points? | Immutability or delete protection blocks the action for the required window | Confirm who can override it, how overrides are logged and whether policy is correctly applied |
| Is the whole environment covered? | Critical data, configurations, identities and dependencies are included | Compare the inventory with backup reports and restore tests |
| How fast can you recover? | Measured restoration time meets business priorities | Run timed tests, including key retrieval and application validation |
| What cloud obligations apply? | Shared-responsibility, residency, retention and deletion requirements are documented | Check provider settings, contract terms and the cost of long immutable retention |
| Where will systems run during recovery? | A clean network, golden images, replacement hardware or reserved capacity is available | Prove that access, licensing and dependencies work during an exercise |
CISA does not rank vendors or products. Its guidance is a set of practices: offline encrypted copies, tested restoration, considered immutability, golden images and monitoring that leads to action.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat common backup assumptions fail during an attack?
- “The job succeeded, so recovery is guaranteed.” Success logs do not test decryption, completeness or application consistency.
- “Cloud means isolated.” A cloud repository can still be reachable through stolen credentials, and immutable settings can be misconfigured or expensive under compliance constraints.
- “Snapshots are backups.” Snapshots stored on the same account, cluster or management plane may be deleted with production data.
- “One removable drive is enough.” A disconnected drive helps, but a single copy can fail, be lost or omit critical systems; rotate protected copies and test them.
- “Antivirus will stop every deployment.” Detection depends on configuration, visibility and response speed. Investigate the compromise even when endpoint protection blocks the final payload.
- “Rebuild first and ask questions later.” Rebuilding without examining persistence and credentials can allow the attacker back in and destroy the replacement environment.
What is the practical standard for ransomware readiness?
You are in a stronger position when an attacker cannot alter every copy with one account, your monitoring can identify unusual access and lateral movement, and your team has already restored critical services in a clean environment. Review those assumptions whenever identity, storage, cloud configuration or recovery priorities change.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently Asked Questions
Can ransomware encrypt an external hard drive used for backups?
Yes, if the drive is connected or mounted when the compromised computer can write to it. Disconnect it after the backup completes, restrict who can reconnect it, and keep additional protected copies because one device can fail or be lost.
Are immutable backups completely safe from ransomware?
Immutability can block deletion during its retention period, but it is not a blanket guarantee. Incorrect policy, exposed administration, compliance conflicts, key loss or deletion after the retention window can still undermine recovery.
Should I shut down every computer as soon as ransomware is detected?
Not automatically. Isolate affected systems and restrict network paths first when possible; abrupt shutdown can destroy volatile evidence. Follow your incident plan and involve qualified responders before rebuilding.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should be restored first after a ransomware incident?
Restore according to business criticality and dependencies, typically beginning with clean identity, core networking and essential data services. Keep rebuilt systems isolated until credentials, monitoring and persistence checks are complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
