Anomalous data modification detected in backup systems, indicating potential tampering activity aimed at covering tracks post data exfiltration. Changes were made to the backup files shortly after unauthorized access was recorded. Observations indicate the presence of malicious IPs and altered backup files.