AWS Backup Recovery Point Deletion as Anti-Recovery Tactic

hello@craftedsignal.io — Fri, 03 Jul 2026 15:54:50 +0000

Threat actors are employing a critical anti-recovery technique by deleting AWS Backup recovery points via the DeleteRecoveryPoint API call. This action, when performed by a non-service principal (i.e., not the AWS Backup service itself), is a strong indicator of malicious activity. AWS Backup recovery points are essential for restoring various protected resources such as EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and S3 buckets. The deletion of these recovery points is a core tactic in ransomware and data-destruction campaigns, as it directly compromises an organization's ability to recover data, thereby maximizing the impact of an attack and increasing pressure on victims. Defenders should prioritize detection and response to such events, investigating the involved principal, affected recovery points, and any correlation with other destructive or evasive activities to prevent irrecoverable data loss.

Attack Chain

Initial Access / Privilege Escalation: An attacker gains unauthorized access to an AWS account, potentially via compromised credentials, misconfigured access policies, or vulnerability exploitation, and obtains sufficient privileges to interact with AWS Backup.
Reconnaissance: The attacker identifies critical AWS Backup recovery points and their associated vaults, determining which protected resources (e.g., EBS, RDS, S3) are most valuable to target for disruption.
Credential Usage: Using compromised AWS credentials (e.g., an IAM user or assumed role), the attacker authenticates to the AWS environment.
Anti-Recovery Action: The attacker invokes the DeleteRecoveryPoint API call, specifying the recovery points to be removed.
Backup Deletion: The AWS Backup service processes the malicious request and permanently deletes the specified recovery points from their respective vaults.
Impact Maximization: The successful deletion prevents the target organization from restoring backed-up data, thereby maximizing the damage from subsequent data encryption or destruction, or increasing leverage in ransomware demands.

Impact

The observed deletion of AWS Backup recovery points has severe consequences, directly eliminating an organization's ability to restore critical data from backups. This technique is specifically designed to maximize the impact of ransomware or data-destruction attacks, often leading to significant operational disruption, irreversible data loss, and substantial financial costs associated with business interruption and recovery efforts. If multiple recovery points or entire vaults are targeted, the potential for widespread data unavailability across an organization's cloud infrastructure is high, rendering recovery attempts extremely difficult without external assistance or succumbing to attacker demands.

Recommendation

Deploy the Sigma rule "AWS Backup Recovery Point Deleted" in this brief to your SIEM and tune for your environment, paying close attention to aws.cloudtrail.user_identity.arn.
Ensure AWS CloudTrail management events are enabled for AWS Backup and ingested into your SIEM for comprehensive monitoring, as required by the detection rule's logsource.
Rotate or restrict credentials for any principal identified in aws.cloudtrail.user_identity.arn if unauthorized DeleteRecoveryPoint activity is suspected.
Implement strong IAM and SCP policies to restrict backup:DeleteRecoveryPoint permissions to a very small set of trusted administrators only.
Preserve any remaining backups and consider enabling AWS Backup Vault Lock on critical vaults to prevent future deletions, referencing the https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html documentation.

AWS Backup Vault Deleted or Vault Lock Removed

hello@craftedsignal.io — Fri, 03 Jul 2026 15:49:19 +0000

This threat brief details the detection of critical anti-recovery actions within Amazon Web Services (AWS) Backup. Adversaries who have gained unauthorized access to an AWS environment may invoke the DeleteBackupVault or DeleteBackupVaultLockConfiguration API calls. These actions are highly impactful because they target an organization's ability to recover from data loss incidents. Removing a Vault Lock defeats the immutability policy designed to protect backups from premature deletion, while deleting an entire backup vault irrevocably destroys all contained recovery points. These activities are rarely observed in legitimate operations and serve as strong indicators of an imminent or ongoing ransomware attack, data destruction, or an attempt to cover tracks following data exfiltration. The threat specifically targets the AWS Backup service, aiming to eliminate recovery options and exacerbate the impact of malicious activity.

Attack Chain

An adversary obtains valid AWS credentials (e.g., IAM user, role access key) through various initial access vectors, gaining unauthorized access to the target AWS account.
The adversary enumerates AWS resources to identify critical AWS Backup vaults containing recovery points that need to be neutralized.
To overcome existing immutability policies, the adversary executes the DeleteBackupVaultLockConfiguration API call to remove the governance-mode lock from a targeted backup vault.
Subsequently, the adversary executes the DeleteBackupVault API call to entirely delete the identified backup vault and its associated recovery points.
These API calls are specifically chosen and executed to prevent the victim organization from restoring data from backups.
The ultimate objective is to inhibit system recovery, making the organization more susceptible to ransomware demands, facilitating data destruction, or covering tracks for data exfiltration.

Impact

The primary impact of successfully deleting AWS Backup vaults or removing Vault Locks is the catastrophic loss of an organization's ability to recover from data loss, ransomware attacks, or accidental deletion. This renders critical data irretrievable, leading to prolonged downtime, significant financial losses due to operational disruption and potential ransom payments, and severe reputational damage. The inability to restore from backups can force organizations to pay ransoms, rebuild systems from scratch, or permanently lose vital business data. While no specific victim counts or sectors are provided in the source, any organization leveraging AWS Backup for disaster recovery is vulnerable.

Recommendation

Deploy the provided Sigma rule "AWS Backup Vault Deleted or Vault Lock Removed" to your SIEM and tune it for your environment.
Ensure AWS CloudTrail management events for AWS Backup are enabled and ingested into your security monitoring platform to activate the rule.
Implement strict Identity and Access Management (IAM) policies that restrict backup:DeleteBackupVault and backup:DeleteBackupVaultLockConfiguration permissions to only highly privileged, break-glass roles.
Regularly audit access to AWS credentials, especially those identified in aws.cloudtrail.user_identity.arn, and review source.ip and user_agent.original for suspicious origins when this detection triggers.
In the event of a detection, immediately review the affected vault from aws.cloudtrail.request_parameters and determine if it contained recovery points, then secure remaining recovery points and re-apply Vault Lock if unauthorized.

AWS Backup - CraftedSignal Threat Feed

AWS Backup Recovery Point Deletion as Anti-Recovery Tactic

Attack Chain

Impact

Recommendation

AWS Backup Vault Deleted or Vault Lock Removed

Attack Chain

Impact

Recommendation