Ransomware
A class of cyber attack in which an adversary encrypts victim data (and increasingly exfiltrates it) and demands payment for restoration and/or non-disclosure. Modern ransomware operators routinely attack backup infrastructure first to make recovery impossible.
The evolution
Through 2018, the dominant playbook was simple: compromise production, encrypt files, demand payment. Mature organisations defeated this with offline backups. By 2022-2024, operators adapted: attack backup infrastructure first, then move to production. By 2026, the standard advanced playbook has three phases: (1) compromise and persist, (2) destroy or encrypt backup capability, (3) double-extort with exfiltration and production encryption.
Why air-gap doesn't scale
The textbook recommendation — air-gapped backups — works for predictable backup windows. It does not work for continuous-data, multi-site enterprises with aggressive recovery objectives. "Immutable storage" with provider-enforced retention is the compromise — but immutability is enforced by the same provider whose plane is in the attacker's potential blast radius.
The multi-cloud RAID alternative
Multi-cloud Reed-Solomon distributes backup shards across seven distinct providers. An attacker compromising one or two provider accounts cannot encrypt or delete the backup. Five providers must be compromised simultaneously — collapsing the economics of the attack.
Even if exfiltrated, the data is ciphertext for which the wrap key was derived only on the original customer's device. Double-extortion fails because there is no readable data to publish.
Recovery operationally
Recovery is the read path in reverse: fetch shard manifest, parallel-pull from any five of seven providers, RS-decode locally, AES-GCM decrypt on the client. No provider needs to be uncompromised. The recovery succeeds as long as any five shards remain readable.
Provable clean restore points
Per-file integrity certificates dual-signed with HMAC-SHA-256 and ML-DSA-87 cryptographically prove which backup version was the last clean one before compromise. Restore decisions become auditable. Read the full analysis →
Where SkyeDATA fits
SkyeDATA — the encrypted backup pipeline — targets the multi-cloud RAID layer. Veeam, AWS Backup, and Bacula retarget at SkyeBucket with one endpoint change.
Related terms
See also
Posts that mention Ransomware
Reed-Solomon erasure coding for storage: a practical primer
Reed-Solomon codes are decades old. They're suddenly central to sovereign cloud architecture. Here's what they do, the math you need, and th…
Read → Architecture · 7 min readWhy multi-cloud RAID beats multi-cloud sync
Most multi-cloud storage products replicate your file inside each provider. SkyeConnex erasure-codes it across them. That distinction is the…
Read → Threat · 8 min readRansomware in 2026: why your backup target is the new attack surface
The 2020s ransomware playbook shifted when crews started encrypting backup targets. Your recovery story dies the moment your backup destinat…
Read →