Continual backup verification for ransomware detection and recovery

A system comprising:

• an execution controller for executing each backup virtual machine (VM) of a plurality of backup VMs in an isolation environment, prior to detecting a cyberattack within a production environment;
• a behavior monitor for monitoring behavior of each executing backup VM to detect malicious logic;
• and
• response logic to, based on at least detecting malicious logic from the behavior monitoring of a first backup VM of the plurality of backup VMs:
• mark the first backup VM as unavailable for backup restore use;
• or
• generate an alert for the first backup VM.

One or more computer storage media having computer-executable instructions that, upon execution by a processor, cause the processor to at least:

• prior to detecting a cyberattack within a production environment, execute each backup virtual machine (VM) of a plurality of backup VMs in an isolation environment;
• for each executing backup VM, monitor behavior to detect malicious logic with a higher probability of detection (Pd) for detection of malicious logic in the isolation environment than a Pd for detection of malicious logic used in the production environment;
• and
• based on at least detecting malicious logic from the behavior monitoring of a first backup VM of the plurality of backup VMs:
• mark the first backup VM as unavailable for backup restore use;
• and
• generate an alert for the first backup VM.