A method for providing secure backup and recovery of files during ransomware attacks or other cyberattacks, the method comprising: storing, by one or more processors, received data (110; 160) at one or more storage nodes (132; 134; 706) coupled via a network to create a data backup at the one or more storage nodes (130; 706); storing, by the one or more processors, duplicated images of the data backup as backup images (172; 524; 720) at a disconnected storage node (150; 204; 408; 522) that is isolated from the network; initiating, by the one or more processors and based on detection of target activity, an alarm state corresponding to the data backup; issuing, by the one or more processors, one or more application programming interface calls (170; 410) to the disconnected storage node based on the alarm state, the API calls (170; 410) to cause retrieval of a most recent backup image from the disconnected storage nodes for use in performing system restore operations; prohibiting, by the one or more processors, access to the data backup at the one or more storage nodes based on the alarm state; and initiating, by the one or more processors, storage of recovered data at one or more other storage nodes coupled via the network to create a second data backup at the one or more other storage nodes by building new edge nodes (214; 526; 644; 714) to restore the most recent backup image, the new edge nodes being an air gap cluster; providing the most recent backup image to the new edge nodes (214; 526; 644; 714); and performing, by the one or more processors, one or more system recovery operations based on the most recent backup image received from the disconnected storage node, wherein the new edge nodes (214; 526; 644; 714) are put into production based on the retrieved backup image to restore the system. storing, by one or more processors, received data (110; 160) at one or more storage nodes (132; 134; 706) coupled via a network to create a data backup at the one or more storage nodes (130; 706); storing, by the one or more processors, duplicated images of the data backup as backup images (172; 524; 720) at a disconnected storage node (150; 204; 408; 522) that is isolated from the network; initiating, by the one or more processors and based on detection of target activity, an alarm state corresponding to the data backup; issuing, by the one or more processors, one or more application programming interface calls (170; 410) to the disconnected storage node based on the alarm state, the API calls (170; 410) to cause retrieval of a most recent backup image from the disconnected storage nodes for use in performing system restore operations; prohibiting, by the one or more processors, access to the data backup at the one or more storage nodes based on the alarm state; and initiating, by the one or more processors, storage of recovered data at one or more other storage nodes coupled via the network to create a second data backup at the one or more other storage nodes by building new edge nodes (214; 526; 644; 714) to restore the most recent backup image, the new edge nodes being an air gap cluster; providing the most recent backup image to the new edge nodes (214; 526; 644; 714); and performing, by the one or more processors, one or more system recovery operations based on the most recent backup image received from the disconnected storage node, wherein the new edge nodes (214; 526; 644; 714) are put into production based on the retrieved backup image to restore the system.