Why ransomware so often destroys backups along with the original data

Ransomware typically does not single out backups; it encrypts whatever files and drives the compromised account can reach, so backups mounted or writable from the infected machine are hit in the same first pass. Attackers also commonly delete shadow copies, local backup catalogues and recovery tools before encrypting, and backup repositories protected only by credentials stored on the same host offer little defence. Backups that survive usually share one of three traits: they are physically disconnected, immutable with retention locks, or isolated from the domain and its credentials. Copies that share network reachability with the original often fail together, and adding an air gap is not feasible once an attack is underway.