Key Takeaways
- Immutable backups are copies of data that cannot be altered, deleted, or encrypted once written, making them the most reliable defence against ransomware that targets backup infrastructure.
- Modern ransomware destroys backups before encrypting live data, so traditional backup setups often fail at exactly the moment they are needed.
- The 3-2-1-1-0 backup rule (three copies, two media types, one offsite, one immutable, zero recovery errors) is the recognised standard for ransomware-resistant architecture.
- Recovery Time Objectives for business-critical systems should target under four hours, which immutable cloud backup makes achievable without paying a ransom.
You’ve done the backup. But is it as clean as you think?
Most Malaysian businesses assume that having backups means having a recovery plan. That assumption holds right up until ransomware hits, at which point a lot of teams discover their backups were either reachable from the same network the attacker compromised, or wiped before the encryption payload even fired. The result is a business with a backup folder full of unusable files and a ransom demand on the table.
This guide covers how immutable backup technology works, why it sits at the centre of ransomware protection for Malaysian businesses, and what a practical setup looks like for organisations without large internal IT teams. Where relevant, it connects to cloud resilience solutions Malaysia businesses can deploy to cover the full continuity picture.
Why Your Backup Might Already Be Compromised
Backups built for hardware failure and accidental deletion are not built for an active attacker with network access and time. That gap is where most ransomware incidents land. Common weaknesses in Malaysian SME backup setups include:
- One backup job, one destination: usually an attached NAS or a single cloud account.
- Shared credentials: the backup admin account is the same one used for everything else.
- No retention beyond a few days: attackers often sit inside networks for several days before triggering encryption, sometimes longer.
- Untested restores: backups run on schedule, but no one has actually recovered from one.
How Ransomware Hunts Backups Before Encrypting Anything
Ransomware groups figured out years ago that a business with clean, tested backups has no reason to pay. So the playbook changed. Modern strains now spend days mapping the environment, locating recovery infrastructure, and destroying it before the encryption payload runs.
Typical backup-targeting moves:
- Snapshot deletion: scripts wipe Windows volume shadow copies and virtualised platform snapshots. LockBit operators have been observed deploying exactly this against VMware environments in Malaysia.
- Backup agent disablement: Veeam, Acronis, or native backup services are stopped or uninstalled.
- Repository overwrite: network-accessible NAS devices and cloud accounts using shared credentials are encrypted or wiped.
- Credential reuse: one stolen admin password reaches production and the only recovery copy.
By the time anyone notices, both the data and the recovery mechanism are gone. The ransomware protection Malaysia SMEs actually need is less about detection tooling and more about whether the backup architecture can survive an attacker who already has admin access.
What Immutable Storage Actually Does
An immutable backup is a copy of data written with a time-locked retention policy, enforced at the storage layer, that prevents any modification or deletion during the lock period. No process, user, or attacker can alter or remove the backup while the lock is active, regardless of what credentials they hold. The lock cannot be toggled off from the application. It is a constraint enforced by the storage infrastructure itself.
Immutability protects recoverability, meaning the data cannot be deleted or overwritten. It does not protect confidentiality. An attacker with storage credentials could still read the backup. Encryption at rest handles the confidentiality side. Both controls are needed, and neither replaces the other.
Building a Ransomware-Resistant Backup Architecture
The traditional 3-2-1 backup rule was written before ransomware became the dominant data-loss event. The 3-2-1-1-0 update adds immutability and verified recovery to cloud backup Malaysia businesses can deploy today. It looks like this:
- 3 copies of data: production plus at least two backup copies.
- 2 different media types: local disk plus cloud object storage, for example. Never both copies on the same NAS.
- 1 copy offsite: a cloud region or second physical location, separate from production.
- 1 copy immutable: locked at the storage layer so no admin or attacker can delete it during the retention window.
- 0 recovery errors: verified by scheduled test restores. A backup that has never been restored is not a backup.
The account writing to the immutable repository should also be distinct from production admin accounts, with multi-factor authentication and limited write permissions. If one compromised password can reach both layers, the immutability still holds, but operational recovery becomes harder.
Recovery Is the Part Most Plans Skip
Having an immutable backup is not the same as being able to recover from one. Recovery is where most plans fall apart, usually because no one has ever tested them under real pressure. A workable recovery plan answers five questions before an incident, not during one:
- What is the Recovery Time Objective (RTO)? Maximum acceptable time between incident and restored operations. For business-critical systems, target under four hours.
- What is the Recovery Point Objective (RPO)? Maximum acceptable data loss measured in time. For transactional systems, target under one hour.
- Who owns the recovery process? Named individuals, with documented contact paths for after hours.
- Where does the clean rebuild happen? A compromised production environment cannot be the recovery target. A separate clean environment or cloud landing zone is required.
- How is recovery tested? Quarterly restore drills, results documented.
For a walkthrough of what actually happens after data is lost, see our companion guide on retrieving lost data
What to Look for in a Malaysian Backup Solution
Backup vendors all promise “secure” and “reliable,” but those words mean different things. When comparing cloud backup Malaysia options, here is what actually matters in plain terms:
- Backups that cannot be deleted, even by an admin: the lock has to sit at the storage layer (Object Lock in compliance mode). If it is just a checkbox in the backup app, an attacker with admin access can switch it off.
- Separate login for the backup system: the password that runs the business should not be the password that controls the backups. One stolen password should never reach both.
- Data scrambled both at rest and in motion: standard encryption (AES-256 for stored data, TLS 1.2 or higher when data is moving) so a stolen backup is unreadable.
- Backups kept for at least 30 to 90 days: attackers can sit inside a network for weeks before triggering encryption. Shorter retention can mean the only “clean” backup left is already corrupted.
- Stored in Malaysia where it makes sense: for PDPA-sensitive data (customer records, payment info, identity documents), a Malaysia-resident option keeps cross-border transfer rules out of the picture.
- Clear recovery promises in writing: how fast the provider commits to restoring operations, and how much data could be lost in a worst case, should be in the contract, not in a sales deck.
- Someone to actually run it for you: for businesses without a dedicated IT team, the provider should own setup, day-to-day monitoring, and the recovery process. Buying software you cannot configure is not the same as being protected.
Getting the Right Protection in Place
Immutable backup is a foundation, not a finished plan. The businesses that recover well from ransomware combine storage-layer immutability with credential separation, tested recovery, and a clean rebuild environment, before the incident happens.
Cue Net Onboard, where AmplifyContinuity delivers a complete continuity service designed for Malaysian businesses without large in-house IT teams. The pillar covers:
- Immutable cloud backup on Object Lock storage, with retention configured to outlast attacker dwell time.
- Documented RTO and RPO targets matched to each workload, not generic service tiers.
- Credential and environment separation between production and backup, so a single compromise cannot reach both.
- Managed restore testing on a scheduled cadence, with results documented for audit and review.
- A clean rebuild environment ready to use when production cannot be trusted.
- PDPA-aligned data residency options for personal data and other sensitive workloads.
To explore how immutable backup fits into a broader continuity plan, see Net Onboard’s cloud resilience solutions for Malaysian businesses and speak to the team about a tailored assessment.
References:
- Ransomware attacks on Malaysian users jumped 153% in 2024, says Kaspersky.
Retrieved on 11 May 2026 from https://theedgemalaysia.com/node/751731 - Cyber Incident Quarterly Summary Report Q2 2025.
Retrieved on 11 May 2026 from https://www.mycert.org.my/portal/advisory?id=SR-031.082025 - 3-2-1 Backup Rule and the Modern 3-2-1-1-0 Update.
Retrieved on 11 May 2026 from https://www.veeam.com/blog/321-backup-rule.html - AWS S3 Object Lock documentation.
Retrieved on 11 May 2026 from https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html - Azure Immutable Blob Storage overview.
Retrieved on 11 May 2026 from https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview - From Legislative Reform to Practical Guidance: Key Amendments to Malaysia’s PDPA.
Retrieved on 11 May 2026 from https://www.mayerbrown.com/en/insights/publications/2025/07/from-legislative-reform-to-practical-guidance-key-amendments-to-malaysias-pdpa-and-the-launch-of-cross-border-transfer-guidelines