The Hybrid Backup Strategy That Defeated Ransomware
The Ransomware Attack That Hit Both On-Prem and Cloud Data, How Our Hybrid Backup Strategy Saved the Day
Ransomware attacks have become far more sophisticated. Modern attackers no longer focus solely on encrypting local file servers. Today’s ransomware groups actively target cloud applications, Microsoft 365 environments, backup systems, shared storage, and administrative accounts in an effort to maximize disruption and increase the likelihood of a ransom payment.
At Epis Technology, we recently worked with an organization that experienced exactly this type of attack. What began as a compromised user account quickly escalated into a coordinated ransomware incident affecting both on-premises infrastructure and cloud-based services.
The attack impacted file shares, user workstations, and portions of the company’s Microsoft 365 environment. Fortunately, the organization had previously invested in a hybrid backup strategy that combined Synology storage, cloud protection, and multiple recovery layers.
That strategy ultimately prevented a potentially devastating business interruption.
The Initial Compromise
The incident began when attackers gained access through a compromised user account.
Initially, the activity appeared legitimate because valid credentials were being used.
Over the following days, the attackers:
- Moved laterally through the network
- Enumerated storage resources
- Identified backup systems
- Accessed shared file repositories
- Gathered information about cloud services
The attack remained largely undetected until ransomware execution began.
The Impact
Within hours, multiple systems became affected.
The organization experienced:
- Encrypted file shares
- Inaccessible business documents
- Disrupted user access
- Locked workstations
- Cloud data concerns
- Operational interruptions
The attack impacted both traditional infrastructure and cloud-based collaboration platforms.
This immediately elevated the incident from a localized problem to an organization-wide crisis.
Why Modern Ransomware Is Different
Many businesses still assume ransomware only targets file servers.
Today’s attackers increasingly target:
- Microsoft 365
- OneDrive
- SharePoint
- Exchange Online
- Backup repositories
- Administrative accounts
The objective is simple: eliminate recovery options and force organizations into paying ransom demands.
This is why modern recovery planning requires multiple protection layers.
Immediate Incident Response
When Epis Technology was engaged, our first priority was containment.
We worked to:
- Isolate affected systems
- Disable compromised accounts
- Review administrative activity
- Secure backup infrastructure
- Preserve recovery options
- Prevent further encryption activity
Rapid containment significantly reduced additional damage.
Evaluating Recovery Options
The next question was critical:
Could the organization recover without paying the ransom?
Fortunately, the answer was yes.
Because the company had implemented a hybrid backup architecture, multiple recovery paths remained available.
The Hybrid Backup Strategy
The organization’s protection strategy included both local and cloud-based recovery resources.
This approach provided resilience against attacks targeting a single environment.
The solution included:
On-Premises Protection
The client utilized Synology infrastructure for centralized storage, snapshots, and backup repositories.
This provided:
- Fast local recovery
- Snapshot-based protection
- Backup isolation
- Storage redundancy
Cloud Backup Protection
Additional cloud-based recovery copies provided:
- Geographic separation
- Independent recovery points
- Long-term retention
- Additional resilience
Microsoft 365 Backup Coverage
Critical Microsoft 365 workloads were protected independently, including:
- Exchange Online
- OneDrive
- SharePoint Online
- Microsoft Teams
This ensured cloud-based collaboration data remained recoverable.
Recovering the Environment
Once containment was complete, Epis Technology initiated recovery operations.
Restoring File Shares
Protected snapshots and backup repositories were used to restore encrypted business files.
Recovering Microsoft 365 Data
Cloud collaboration platforms were validated and restored where necessary.
Rebuilding Critical Systems
Affected devices and services were restored using clean recovery points.
Verifying Data Integrity
Recovered information was reviewed to ensure operational accuracy and completeness.
Because multiple recovery layers existed, the organization was able to restore operations without negotiating with attackers.
Lessons Learned
The attack reinforced several important realities.
Organizations should never assume:
- Cloud platforms are immune to ransomware
- Backups cannot be targeted
- Single recovery layers are sufficient
- Native retention policies replace backups
Effective protection requires multiple independent recovery options.
Strengthening Security After Recovery
Following the recovery effort, Epis Technology helped the client improve:
- Multi-factor authentication
- Administrative controls
- Backup monitoring
- Endpoint security
- Security awareness training
- Recovery testing procedures
The objective was to improve both prevention and resilience.
The Results
Following recovery, the organization achieved:
- Successful restoration of critical data
- Recovery without paying ransom demands
- Improved security controls
- Stronger backup resilience
- Better business continuity planning
- Enhanced recovery readiness
Most importantly, the company avoided a potentially catastrophic loss of business operations.
Why Hybrid Backup Matters
Modern businesses operate across multiple environments.
Critical information often resides in:
- Microsoft 365
- Cloud applications
- On-premises storage
- Virtual infrastructure
- Shared collaboration platforms
A hybrid backup strategy protects these environments through multiple independent recovery layers.
When ransomware strikes, organizations with diversified backup architectures are far better positioned to recover quickly and confidently.
About Epis Technology
Epis Technology helps organizations protect business-critical systems through Synology consulting, hybrid backup strategies, Microsoft 365 protection, disaster recovery planning, and cybersecurity resilience services. The company specializes in enterprise storage solutions, cloud data protection, Microsoft 365 and Google Workspace backups, fully managed PC backups, and business continuity planning.
By combining secure backup architecture, proactive monitoring, and proven recovery expertise, Epis Technology helps businesses maintain operational continuity even when facing sophisticated ransomware threats.