Backups are widely treated as the last line of defence against ransomware and destructive attacks. In practice, they are often among the first systems deliberately targeted once an attacker gains a foothold in an environment. This talk explores how modern adversaries identify, access, and ultimately compromise backup infrastructure using techniques that are broadly applicable across enterprise platforms, regardless of vendor or architecture.

We begin by examining how backup systems are discovered through common enterprise artifacts, including Active Directory enumeration, service account analysis, DNS and naming conventions, and opportunistic network scanning. These methods frequently reveal high-value systems that are insufficiently segmented or monitored. From there, we walk through realistic attack paths that exploit weak identity boundaries, overprivileged service accounts, and insecure credential storage mechanisms commonly found in backup environments.

We will discuss how a low-privileged domain user can escalate access to the backup control plane by extracting stored credentials and abusing management interfaces. We then highlight how attackers leverage legitimate administrative functionality—such as APIs, scripting interfaces, and job management tools—to silently delete backup chains, alter retention policies, or degrade recovery capabilities over time. Because these actions closely resemble normal administrative behaviour, they often evade traditional detection controls and generate little to no actionable telemetry.

The talk also explores data-plane attacks against backup repositories, including direct file manipulation, snapshot and version deletion in object storage, and timing-based strategies designed to bypass retention and immutability safeguards. We highlight lesser-known failure modes, such as delayed destruction and incremental chain corruption, which can leave organizations with a false sense of recoverability until recovery is actually required.

In addition to offensive techniques, we place a strong emphasis on defensive engineering and layered protection strategies. We will discuss how to design backup environments that can withstand these attack paths through identity isolation, strict least-privilege models, resilient immutability configurations, and independent control planes. We will also cover practical detection approaches, including monitoring for anomalous administrative actions, API abuse, and mass deletion events, as well as strategies for validating recovery integrity through continuous testing.

Attendees will leave with a deeper understanding of the backup attack surface, how these attacks unfold in real environments, and concrete, vendor-neutral approaches to protect and harden their backup and recovery strategy against a determined adversary.