>if you're talking about theoretical attacks where the software figures out how to actively mount a network drive that isn't already mounted in order to wreck i

>if you're talking about theoretical attacks where the software figures out how to actively mount a network drive that isn't already mounted in order to wreck it, then you may as well speculate about it figuring out how to delete data from your Amazon S3 bucket Yeah, and that is precisely where I started my question. To quote (from the post you have replied to): [...] I see that the AWS S3 IAM user has both read and write access, so if the ransomware authors ever bother with it, they can kill the backups. [...]