{"id":55532,"date":"2026-03-31T09:35:22","date_gmt":"2026-03-31T13:35:22","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=55532"},"modified":"2026-03-31T09:35:39","modified_gmt":"2026-03-31T13:35:39","slug":"preventing-ransomware-attacks-on-backups-of-home-users","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/preventing-ransomware-attacks-on-backups-of-home-users\/55532\/","title":{"rendered":"Ransomware now taking aim at personal backups"},"content":{"rendered":"

Today \u2014 March 31 \u2014 is World Backup Day. And every year, most people tell themselves, \u201cI\u2019ll get around to that tomorrow\u201d. But even if you\u2019re one of the responsible ones who regularly backs up their docs, photo archives, and the entire operating system \u2014 you\u2019re still at risk. Why? Because ransomware has learned how to specifically target everyday users\u2019 backups.<\/p>\n

Why home users are in the crosshairs<\/h2>\n

In the not-so-distant past, ransomware was mostly a big business problem. Attackers focused on corporate servers and enterprise backups because freezing a major company\u2019s production process or stealing all their information and customer databases usually meant a massive payout. We\u2019ve seen plenty of those cases over the last few years. However, the \u201csmall-fry\u201d market has become just as tempting for cybercriminals \u2014 and here\u2019s why.<\/p>\n

For starters, attacks are automated. Modern ransomware doesn\u2019t need a human operating it manually. These programs scan the internet for vulnerable devices and, upon finding one, encrypt everything indiscriminately without the hacker getting involved. This means a single attacker can effortlessly hit<\/a> thousands of home devices.<\/p>\n

Second, because of this broad reach, the ransom demands have become more \u201caffordable\u201d. Regular users aren\u2019t asked for millions, but \u201conly\u201d a few hundred or thousand dollars. Many people are willing to pay that amount without involving the police \u2014 especially when family archives, photos, medical records, banking documents, and other personal files are on the line, with no other copies in existence. And when you multiply those smaller payouts by thousands of victims, the hackers walk away with very tidy sums.<\/p>\n

And finally, home devices are usually sitting ducks. While corporate networks are guarded really well, the average home router most likely runs on factory settings with \u201cadmin\u201d as the password. Many people leave their network attached storage (NAS) wide open to the internet with zero protection<\/a>. It\u2019s low-hanging fruit.<\/p>\n

How personal backups get attacked<\/h2>\n

A home NAS drive \u2014 often called a personal cloud \u2014 is essentially a mini-computer running a specialized Linux or FreeBSD-based operating system. It houses one or more large-capacity hard drives, often combined into an array. The storage connects to a home router, making files accessible from any device on the home network \u2014 or even remotely over the internet if you\u2019ve configured it that way. Many people buy a NAS specifically to centralize their family\u2019s backups and simplify access for family members, thinking it\u2019s the ultimate safe haven for their digital archives.<\/p>\n

The irony is that these very storage hubs have become the primary target for ransomware gangs. Hackers can break in relatively easily either by exploiting known vulnerabilities or simply brute-forcing a weak password. Over the last five years, there were several major ransomware attacks specifically targeting home NAS units made by QNAP, Synology, and ASUSTOR.<\/p>\n

Targeting NAS isn\u2019t the only way hackers can get to your files. The second method relies on social engineering: basically tricking victims into launching malware themselves. Take the massive AI hype of 2025, for example. Scammers would set up malicious websites distributing fake installers for ChatGPT, Invideo AI, and other trending tools. They would lure people in with promises of free premium subscriptions, but in reality users ended up downloading and running ransomware<\/a>.<\/p>\n

What ransomware looks for once it\u2019s inside<\/h2>\n

Once the malware infiltrates your system, it starts surveying its environment and neutralizing anything that could help you recover your data without paying up.<\/p>\n