Pricing the Ransom, Hunting the Backup

Two behaviors puzzle people about ransomware until they see the economics, at which point both become obvious. Why is the ransom priced the way it is? And why do attackers go after backups first, before they do anything else? The answers are the same answer, and it is the beating heart of this module.

Start with pricing, because it reveals the logic. A naive attacker demands as much as possible. A sophisticated one — a business — demands the amount most likely to be paid, which is a very different number. The rational victim does not compare the ransom to zero; a victim in crisis compares the ransom to their next-best alternative. And their next-best alternative is to recover on their own: rebuild systems, restore from backups, absorb the downtime. That alternative has a cost — in hours, in lost revenue, in overtime and reputation — and that cost is the real ceiling on what the attacker can charge. Price the ransom a dollar below the victim's cost of recovering without you, and a coldly rational victim pays, because paying is the cheaper path. The ransom is not priced to your pain. It is priced to your alternative. Faraday's read: the demand is a mirror of your recovery plan. A well-set ransom tells you the attacker estimated what it would cost you to say no — and set the price just under it.

Now the whole strategy snaps into focus, and it points like a compass needle straight at your backups. The victim's cost of recovering without paying is not fixed. It depends almost entirely on one thing: can they restore from backup? A victim with clean, reachable, recent backups has a cheap alternative to paying — restore, lose some hours, refuse the demand. For that victim the ransom is worth little, because their next-best option is good. A victim whose backups are gone, encrypted, or unreachable has no cheap alternative. For them, recovery might mean rebuilding from nothing over weeks. Their next-best option is catastrophic, so the price the attacker can charge is enormous.

So the attacker's most valuable single action is not encrypting your production systems. It is destroying your backups. Backups are the victim's leverage — the thing that lets them walk away. Neutralize the backups and you have removed the victim's ability to say no, which converts an inconvenience into a debt they will pay to escape. This is why mature ransomware operations hunt backups first and deliberately: they find the backup servers, encrypt or delete them, verify they're gone, and only then trigger the visible attack. By the time you see the ransom note, your escape route was closed hours ago, quietly, on purpose. The loud part is the last part. The important part was silent.

This is where the course's cleanest analogy earns its place, and it ties this module back to the reliability engineering you already know. A reachable backup is the cyber analogue of two generators in one flooded basement. You bought two generators for redundancy, reasoning that one might fail — sound thinking against random failure. But if you put both in the same basement, a single flood takes both at once. The redundancy was an illusion because the two units shared a fate. In cyber terms, a backup that sits on the same network as your production systems, reachable by the same credentials, is a second generator in the same basement. The 'flood' — an attacker with domain access — reaches the backup by the identical path it used to reach production. You thought you had two independent lines of defense. You had one failure that takes both, because they share a fate the attacker can trigger with a single reach.

The fix follows directly from the analogy, and it is the practical payload of this lesson: the backup has to be somewhere the flood cannot reach. In the generator case, you put the second generator on the roof — different fate, no shared basement. In cyber, that means a backup an attacker with full run of your production network still cannot destroy: kept offline, or on a system that only ever receives data and never lets it be deleted or altered on command, or otherwise isolated so that compromising production does not hand over the backups. The technical means vary, but the principle is singular and non-negotiable — the backup and the thing it protects must not share a fate. If one reach kills both, you do not have a backup. You have a decoration that will not be there when the flood comes.