Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP.